CVE-2026-0939CWE-345

Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation

Medium · published January 16, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including, 5.1.2. This is due to the plugin failing to verify the authenticity of payment callbacks. This makes it possible for unauthenticated attackers to manipulate WooCommerce order statuses, either marking unpaid orders as paid, or failed.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00175 · 6.7th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-01-16T06:43Z
EPSS history
Timeline
  • 16 JAN 06:43Z
    Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation
    cvelistv5