Rede Ita For Woocommerce
Monthly
Order status manipulation in Rede Itaú for WooCommerce before 5.5.3 allows unauthenticated remote attackers to change arbitrary WooCommerce order states - including marking unpaid orders as paid and cancelling completed orders - by forging payment gateway webhook requests. Publicly available exploit code exists, though the impact is limited to integrity (CVSS 5.3) and requires the plugin to be installed and its webhook endpoint reachable. No special configuration or user interaction is needed, but exposure is limited to merchants using the Itaú (Brazil) payment gateway.
Unauthenticated attackers can arbitrarily change the status of WooCommerce orders - including orders already marked paid or completed - by sending forged callbacks to the payment webhook endpoint of the Rede Itaú for WooCommerce WordPress plugin, which performs no authenticity verification on incoming requests. Any store running the plugin at a version prior to 5.5.3 with an active, network-reachable webhook URL is exposed remotely and without credentials (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the impact is confined to order-status integrity with no data disclosure or denial of service. Publicly available exploit code exists and the issue was reported by WPScan, though it is not confirmed as actively exploited (no CISA KEV listing); the deployment base is narrow - merchants using the Itaú gateway, largely in Brazil - which limits real-world exposure and keeps this a moderate-severity integrity flaw rather than an emergency.
Order status manipulation in Rede Itaú for WooCommerce before 5.5.3 allows unauthenticated remote attackers to change arbitrary WooCommerce order states - including marking unpaid orders as paid and cancelling completed orders - by forging payment gateway webhook requests. Publicly available exploit code exists, though the impact is limited to integrity (CVSS 5.3) and requires the plugin to be installed and its webhook endpoint reachable. No special configuration or user interaction is needed, but exposure is limited to merchants using the Itaú (Brazil) payment gateway.
Unauthenticated attackers can arbitrarily change the status of WooCommerce orders - including orders already marked paid or completed - by sending forged callbacks to the payment webhook endpoint of the Rede Itaú for WooCommerce WordPress plugin, which performs no authenticity verification on incoming requests. Any store running the plugin at a version prior to 5.5.3 with an active, network-reachable webhook URL is exposed remotely and without credentials (CVSS 5.3, AV:N/AC:L/PR:N/UI:N, C:N/I:L/A:N), and the impact is confined to order-status integrity with no data disclosure or denial of service. Publicly available exploit code exists and the issue was reported by WPScan, though it is not confirmed as actively exploited (no CISA KEV listing); the deployment base is narrow - merchants using the Itaú gateway, largely in Brazil - which limits real-world exposure and keeps this a moderate-severity integrity flaw rather than an emergency.