Rede Ita For Woocommerce Payment Pix Credit Card And Debit
Monthly
Unauthenticated attackers can mark pending orders as paid in the Rede Itaú for WooCommerce plugin before 5.4.7 by abusing its PIX payment webhook, which fails to verify authenticity before updating order status. The issue affects stores running versions from 3.6.1 up to 5.4.7 with the PIX payment method enabled, requires no authentication or user interaction, and produces integrity-only financial fraud impact rather than code execution or data disclosure. Publicly available exploit code exists, and exploitation is straightforward once a pending order and reachable webhook are present; the vendor-released fix is version 5.4.7.
Unauthenticated attackers can mark pending orders as paid in the Rede Itaú for WooCommerce plugin before 5.4.7 by abusing its PIX payment webhook, which fails to verify authenticity before updating order status. The issue affects stores running versions from 3.6.1 up to 5.4.7 with the PIX payment method enabled, requires no authentication or user interaction, and produces integrity-only financial fraud impact rather than code execution or data disclosure. Publicly available exploit code exists, and exploitation is straightforward once a pending order and reachable webhook are present; the vendor-released fix is version 5.4.7.