Skip to main content

Rede Itaú WooCommerce CVE-2026-92430

| EUVDEUVD-2026-83516 MEDIUM
Missing Authorization (CWE-862)
2026-09-19 WPScan GHSA-mhj8-f8qj-pvcj
WordPress Authentication Bypass Woocommerce Rede Ita For Woocommerce Payment Pix Credit Card And Debit
5.3
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
5.3 MEDIUM

Public unauthenticated webhook forgeable over the network with low complexity (AV:N/AC:L/PR:N/UI:N); impact is limited to order-status integrity (I:L), no confidentiality or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

5
Metadata Corrected
Sep 19, 2026 - 14:40 vuln.today
tag: Woocommerce added
Analysis Generated
Sep 19, 2026 - 14:25 vuln.today
Patch available
Sep 19, 2026 - 07:16 EUVD
CVE Published
Sep 19, 2026 - 06:00 cve.org
MEDIUM 5.3
CVE Published
Sep 19, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The Rede Itaú for WooCommerce - Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.

AnalysisAI

Unauthenticated attackers can mark pending orders as paid in the Rede Itaú for WooCommerce plugin before 5.4.7 by abusing its PIX payment webhook, which fails to verify authenticity before updating order status. The issue affects stores running versions from 3.6.1 up to 5.4.7 with the PIX payment method enabled, requires no authentication or user interaction, and produces integrity-only financial fraud impact rather than code execution or data disclosure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires the target site to be running the 'Rede Itaú for WooCommerce - Payment PIX, Credit Card and Debit' plugin at a version from 3.6.1 up to (not including) 5.4.7, with the PIX payment method enabled so its webhook endpoint is reachable. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine unauthenticated remote issue but with narrow, integrity-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Upgrade the Rede Itaú for WooCommerce - Payment PIX, Credit Card and Debit plugin to version 5.4.7 or later, which is the vendor-released patched version. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Woocommerce

View all
CVE-2017-17058 HIGH POC
7.5 Nov 29

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
CVE-2021-24212 CRITICAL POC
9.8 Apr 05

The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
CVE-2022-50972 CRITICAL POC
9.3 Jun 20

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by

CVE-2020-35627 HIGH POC
8.8 Dec 28

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
CVE-2026-14962 HIGH POC
8.6 Sep 09

Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
CVE-2026-92404 HIGH POC
7.5 Sep 19

Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync

CVE-2023-34000 HIGH POC
7.5 Jun 14

Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
CVE-2020-11497 HIGH POC
7.5 Aug 26

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
CVE-2026-74925 HIGH POC
7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
CVE-2023-47777 MEDIUM POC
6.5 Nov 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
CVE-2023-3508 MEDIUM POC
6.5 Jul 31

The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when processing its tab actions, which

CVE-2023-3507 MEDIUM POC
6.5 Jul 31

The WooCommerce Pre-Orders WordPress plugin before 2.0.3 has a flawed CSRF check when canceling pre-orders, which could

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Share

CVE-2026-92430 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy