CVE-2026-92430: Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress pluginto a version that resolves this vulnerability.Fixed in 5.4.7
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
WordPress sites using Rede Itaú for WooCommerce versions earlier than 5.4.7 are affected. The vulnerable functionality is the PIX payment webhook.
What does an attacker need to exploit it?
An attacker does not need to authenticate. They can submit a PIX webhook request that causes a pending order to be marked as paid without making a payment.
How can I determine whether my site is affected?
Check the installed version of the Rede Itaú for WooCommerce plugin. Versions before 5.4.7 are affected; version 5.4.7 or later is not identified as affected by this report.