EUVD-2026-101861
GHSA-fgw2-qjhx-x8qq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach store webhook endpoint
-
DeliveryCraft forged gateway callback
-
ExploitSubmit unauthenticated webhook
-
ExecutionPlugin updates order status
-
ImpactFraudulent order state applied
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V15 - Secure Coding and Architecture Data authenticity verification
|
| Exploitation Conditions | No special conditions beyond the plugin being installed and active - any store running Rede Itaú for WooCommerce prior to 5.5.3 is exploitable remotely and unauthenticated (AV:N/AC:L/PR:N/UI:N) because the payment webhook endpoint performs no authenticity verification on incoming callbacks. The only practical limiting factors are that the plugin must be installed/enabled, the webhook callback URL must be network-reachable, and impact is confined to WooCommerce order-status manipulation (integrity) - there is no data exposure or denial of service. The narrow deployment base (merchants using the Itaú gateway, largely in Brazil) further limits real-world exposure. |
| Impact | This is a moderate-severity integrity flaw, not a high-priority emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, but the impact is limited to integrity only (C:N/I:L/A:N) - an attacker can flip WooCommerce order statuses but cannot read data or cause outages, which is why the score caps at 5.3 (Medium). Public exploit code exists (reported by WPScan), raising the practical likelihood of opportunistic abuse, though no EPSS probability or SSVC decision data was supplied and the CVE is NOT on CISA KEV, so there is no evidence of active in-the-wild exploitation. The realistic risk is business/financial fraud against individual merchants (e.g. marking unpaid orders as paid) rather than mass infrastructure compromise. Note a data conflict: the input Tags label this 'Information Disclosure,' but the description and CVSS (C:N, I:L) describe a broken-webhook-authentication / integrity issue with no confidentiality impact - the tag appears mislabeled. |
| Exploit ScenarioDerived | An attacker who knows a shop runs the Rede Itaú for WooCommerce plugin sends a forged payment-gateway webhook directly to the plugin's callback endpoint, which does not verify the request's authenticity. Using the publicly available exploit, they mark an unpaid order as 'paid/completed' (triggering fulfillment of goods without payment) or alter the status of existing paid orders. No credentials, user interaction, or special conditions are required beyond network reachability of the store. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 15, 2026
Unauthenticated attackers can arbitrarily change the status of WooCommerce orders - including orders already marked paid or completed - by sending forged callbacks to the payment webhook endpoint of the Rede Itaú for WooCommerce WordPress plugin, which performs no authenticity verification on incoming requests. Any store running the plugin at a version prior to 5.5.3 with an active, network-reachable webhook URL is exposed remotely and without credentials (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the impact is confined to order-status integrity with no data disclosure or denial of service. Publicly available exploit code exists and the issue was reported by WPScan, though it is not confirmed as actively exploited (no CISA KEV listing); the deployment base is narrow - merchants using the Itaú gateway, largely in Brazil - which limits real-world exposure and keeps this a moderate-severity integrity flaw rather than an emergency.
RemediationAI
Vendor-released patch: upgrade Rede Itaú for WooCommerce to 5.5.3 or later, the fixed version identified by the plugin's own WPScan advisory at https://wpscan.com/vulnerability/106c8da0-cfb5-49da-8c6d-cb56e8cbc4c2/ - because the callback handler change is server-side, updating the plugin is sufficient and no WooCommerce data migration is required. If the update cannot be applied immediately, the most reliable compensating control is to deactivate the plugin until it can be patched; this stops all gateway-driven order updates and therefore requires the merchant to reconcile Itaú payments manually, which is operationally costly but eliminates the exposure. A less disruptive option is to restrict network access to the webhook callback URL at the web server or WAF layer, allowing only the payment provider's published source IP ranges - this preserves legitimate order updates but breaks if the provider's egress addresses change or if the store sits behind a proxy that rewrites the client IP. Blocking or filtering requests to the callback path on the basis of missing or unexpected parameters is a weaker alternative, since the vulnerability is the absence of a cryptographic authenticity check rather than a malformed-input condition. Regardless of which mitigation is chosen, merchants should review recent WooCommerce order status transitions for unexplained changes to paid, completed, or refunded orders, and restore correct statuses manually, since the plugin will have accepted forged status values without leaving a provider-side record. Apply any provided WPScan exploit details only in a test environment to confirm the fix; no CISA KEV entry exists, so this does not require emergency incident response, but the existence of public exploit code makes prompt patching advisable given how trivial the forged request is.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a WordPress/WooCommerce payment-gateway integration plugin for the Rede/Itaú processor. Gateway integrations of this kind expose a public callback endpoint that the payment provider hits after a transaction to synchronize order state - for example, flipping an order from pending to processing or completed. Because that endpoint must be reachable from the Internet without a logged-in WordPress session, the only thing separating a legitimate gateway callback from an attacker-controlled one is authenticity verification: an HMAC/shared-secret signature, an allow-listed source, or a secret token compared before any state change. This plugin omits that step entirely, so it applies whatever status value arrives in the request body. The input lists no CWE mapping, but the flaw corresponds to the missing-verification-of-authenticity class (CWE-345), and it maps precisely to the assessed vector's PR:N/UI:N and I:L components - no privileges or user interaction are required, and the consequence is modified order records, not confidentiality or availability loss. The supplied CPE, cpe:2.3:a:unknown:rede_itaú_for_woocommerce:*:*:*:*:*:*:*:*, carries an unknown vendor field and a wildcarded version, reflecting that the plugin is tracked through WPScan rather than a fully enumerated NVD product entry; the only reliable version boundary in the provided data is 'before 5.5.3'.
Know when Woocommerce gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated remote forged webhook (AV:N/AC:L/PR:N/UI:N) with limited integrity impact on order status only; no confidentiality or availability effect.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
Unauthenticated arbitrary file upload in Addify's Request a Quote for WooCommerce plugin, affecting all versions up to a
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Unauthenticated path traversal in OrderConvo (the "Admin and Customer Messages After Order for WooCommerce" plugin), aff
Unauthenticated remote attackers can seize control of the payment configuration on WordPress stores running the Fundiin
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated attackers can exploit the Walletdoc Payment Gateway for WooCommerce plugin before version 1.8.5 to execu
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Exploit-DB