CVE-2026-92428: Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rede Itaú for WooCommerceto a version that resolves this vulnerability.Fixed in 5.5.3
Event History
Frequently Asked Questions
Which installations are affected?
Installations using Rede Itaú for WooCommerce versions earlier than 5.5.3 are affected. The issue concerns the plugin's handling of payment gateway webhooks that update WooCommerce order status.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to submit a webhook that causes the plugin to update the status of a targeted WooCommerce order.
What is the practical impact on orders?
An unauthenticated attacker can change the status of arbitrary WooCommerce orders, including orders that have already been paid or completed. The provided information identifies integrity impact only; it does not indicate confidentiality or availability impact.
How can this be remediated?
Update Rede Itaú for WooCommerce to version 5.5.3 or later. Versions before 5.5.3 do not verify webhook authenticity before changing order status.