CVE-2026-92429: Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rede Itaú for WooCommerceto a version that resolves this vulnerability.Fixed in 5.5.3
Event History
Frequently Asked Questions
Which installations are affected?
Rede Itaú for WooCommerce versions 3.7.1 through 5.5.2 are affected. Versions before 5.5.3 do not verify the authenticity of the relevant payment gateway webhook.
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They can submit a forged maxiPago Debit webhook that causes the plugin to update arbitrary WooCommerce order statuses.
What is the business impact of exploitation?
Attackers can mark unpaid orders as paid or cancel completed orders. This can lead to fulfillment of orders that were not paid for and disruption of legitimate completed orders.
What should be done if immediate patching is not possible?
The provided information identifies no workaround. Prioritize upgrading to version 5.5.3 or later, which is outside the affected versions.