CVE-2026-40741 Overview
CVE-2026-40741 is a broken access control vulnerability affecting the Redsys for WooCommerce Light WordPress plugin in versions 7.0.0 and earlier. The flaw allows unauthenticated attackers to invoke privileged plugin functionality over the network without supplying credentials or interacting with a user. The weakness maps to CWE-862: Missing Authorization, where plugin endpoints fail to verify whether the requester is permitted to perform the requested action. WooCommerce stores that integrate the Redsys payment gateway through this plugin are exposed to integrity-impacting requests against the affected functionality.
Critical Impact
Unauthenticated remote attackers can abuse missing authorization checks in the Redsys for WooCommerce Light plugin to modify state on affected WordPress sites without credentials.
Affected Products
- Redsys for WooCommerce Light WordPress plugin versions <= 7.0.0
- WordPress sites running WooCommerce with the woo-redsys-gateway-light plugin
- E-commerce deployments integrating the Redsys payment gateway via the Light plugin variant
Discovery Timeline
- 2026-06-15 - CVE-2026-40741 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-40741
Vulnerability Analysis
The vulnerability stems from missing authorization checks in the Redsys for WooCommerce Light plugin. The plugin exposes functionality that should be restricted to authenticated or privileged users but accepts requests from any unauthenticated client. An attacker reaches the affected handler over the network without prior access to the WordPress installation.
The Common Weakness Enumeration classification is [CWE-862], which describes software that does not perform an authorization check when a user attempts to access a resource or perform an action. The CVSS vector indicates high impact to integrity, while confidentiality and availability remain unaffected. This pattern is consistent with state-changing endpoints — such as configuration updates or order-related actions — that lack capability checks or nonce verification.
The EPSS probability of 0.246% places the vulnerability in the 15th percentile for likelihood of exploitation in the wild at publication. No public proof-of-concept or active exploitation has been reported.
Root Cause
The root cause is the absence of an authorization control on one or more plugin request handlers. WordPress plugins typically guard privileged actions with current_user_can() capability checks and check_admin_referer() or wp_verify_nonce() calls. When these checks are omitted or applied to the wrong code path, any visitor can trigger the action by sending a crafted HTTP request to the plugin endpoint.
Attack Vector
The attack vector is network-based with low complexity. An attacker sends an HTTP request to the vulnerable plugin endpoint on a target WordPress site running woo-redsys-gateway-light version 7.0.0 or earlier. No authentication, no privileges, and no user interaction are required. Successful exploitation results in unauthorized modification of data or configuration controlled by the affected handler. Refer to the Patchstack advisory for additional technical context.
Detection Methods for CVE-2026-40741
Indicators of Compromise
- Unauthenticated HTTP POST or GET requests targeting woo-redsys-gateway-light plugin endpoints under /wp-admin/admin-ajax.php or /wp-admin/admin-post.php
- Unexpected modifications to WooCommerce order status, payment configuration, or plugin settings without a corresponding administrator session
- Access log entries showing repeated requests to plugin handlers from external IP addresses without prior authentication cookies
Detection Strategies
- Inventory all WordPress sites and identify installations of woo-redsys-gateway-light at version <= 7.0.0
- Monitor web server access logs for anomalous request patterns to plugin-specific action parameters
- Correlate WooCommerce audit events with authentication logs to identify state changes performed without a valid admin session
Monitoring Recommendations
- Enable WordPress activity logging plugins to capture settings changes, plugin actions, and order state transitions
- Forward web server and WordPress logs to a centralized analytics platform for retention and querying
- Alert on HTTP 200 responses to unauthenticated requests targeting plugin admin actions
How to Mitigate CVE-2026-40741
Immediate Actions Required
- Update the Redsys for WooCommerce Light plugin to the patched release published after version 7.0.0 as soon as it is available from the vendor
- Audit WooCommerce payment configuration and recent orders for unauthorized modifications
- Restrict administrative endpoints behind a web application firewall (WAF) policy that requires authentication
Patch Information
Review the Patchstack vulnerability database entry for current patch availability and the fixed version of woo-redsys-gateway-light. Apply vendor updates through the WordPress plugin manager or by replacing the plugin directory with the patched release.
Workarounds
- Disable and remove the woo-redsys-gateway-light plugin until a patched version is installed if the Redsys payment gateway is not actively required
- Deploy a WAF rule that blocks unauthenticated requests to the plugin's action endpoints
- Restrict access to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php at the network edge where feasible
# Example: temporarily deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate woo-redsys-gateway-light
wp plugin status woo-redsys-gateway-light
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
