CVE-2026-92430 in Rede Itaú for WooCommerce Plugin
Summary
by MITRE • 09/19/2026
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/19/2026
The vulnerability identified in Rede Itaú for WooCommerce versions prior to 5.4.7 represents a critical failure in authentication and integrity verification within the plugin’s handling of payment webhooks. Specifically, the component responsible for processing PIX payments fails to validate the authenticity of incoming webhook requests from the payment gateway before updating the order status in the WordPress database. This architectural flaw allows any actor with network access to the server hosting the WooCommerce instance to manipulate transaction states without completing actual financial transactions. The core technical issue lies in the absence of cryptographic signature verification or token-based authentication mechanisms when processing callbacks that signal a successful payment, which is a standard security requirement for asynchronous payment integrations.
From an operational perspective, this vulnerability enables unauthenticated attackers to mark pending orders as paid by sending forged webhook requests to the designated endpoint. This action bypasses the legitimate financial settlement process, effectively allowing users or malicious actors to obtain goods and services without paying. The impact extends beyond immediate revenue loss; it can lead to inventory discrepancies, fulfillment errors for merchants who ship items based on false payment confirmations, and potential reputational damage due to perceived unreliability of the e-commerce platform. Furthermore, if such manipulation is automated at scale, it could be used to exploit promotional offers or limited-stock items by artificially inflating order counts while bypassing actual payment gates.
This flaw aligns with CWE-345, which describes Insufficient Verification of Data Authenticity, as the system accepts data from an external source without confirming its origin or integrity. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, although in this context it is more accurately characterized by unauthorized access through lack of authentication rather than credential theft. The vulnerability falls under the broader category of Broken Access Control and Insecure Direct Object References if specific order IDs are targeted directly via manipulated parameters within the webhook payload.
Mitigation strategies must focus on implementing robust verification mechanisms for all incoming webhooks. Developers should enforce strict validation of digital signatures provided by the payment gateway, ensuring that each request is cryptographically signed with a secret key known only to the server and the payment processor. Additionally, implementing idempotency checks can prevent duplicate processing of webhook events, while rate limiting can mitigate automated abuse attempts. Upgrading to version 5.4.7 or later resolves this issue by introducing proper authentication checks for PIX payment callbacks. Until an upgrade is performed, administrators should consider restricting access to the specific webhook endpoint via IP whitelisting if possible, although cryptographic verification remains the primary and most effective defense against such manipulation.