Rede Itaú EUVD-2026-101862

No special conditions beyond the plugin being installed and active - the target must run Rede Itaú for WooCommerce before version 5.5.3 with its payment webhook/callback endpoint reachable, which is the default for the plugin to function. Exploitation is remote and fully unauthenticated (PR:N, UI:N) against the default configuration because the plugin never verifies the webhook's authenticity or origin. The practical limiting factor is footprint rather than configuration: this gateway is specific to merchants using Itaú (Brazil), so only that population is exposed; there is no required user interaction, credential, or non-default setting to bypass.

This is a genuine but moderate-priority issue, not a top-tier emergency. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which is why a public POC from WPScan is credible and concerning. However, the impact is scoped narrowly to integrity (C:N/I:L/A:N) - attackers can flip WooCommerce order states but cannot read data or crash the service, keeping the base score at 5.3 (Medium). No EPSS score is provided in the input, so exploitation probability cannot be quantified here. It is NOT on CISA KEV and there is no evidence of active exploitation - only publicly available exploit code, which is a distinct and lower signal than in-the-wild use. The real-world risk is amplified by the business-logic nature of the flaw (marking unpaid orders as paid enables fraud/theft of goods; cancelling completed orders enables disruption), but dampened by the plugin's narrow deployment footprint. Net: prioritize patching for any merchant running this specific gateway, but it is not a mass-exploitation internet-wide crisis.

An attacker identifies a store running Rede Itaú for WooCommerce below 5.5.3 and sends a forged payment-gateway webhook request to the plugin's callback endpoint without any authentication. Because the plugin does not validate the webhook's authenticity, the attacker marks their own unpaid order as 'paid' to receive goods for free, or mass-cancels legitimate completed orders to disrupt the merchant. A public POC exists (WPScan), lowering the skill barrier for abuse.