CVE-2026-0942CWE-306

Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion

Medium · published January 16, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
23.2
In the wild
Unconfirmed
What it is

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs() function in all versions up to, and including, 5.1.5. This makes it possible for unauthenticated attackers to delete the Rede Order Logs metadata from all WooCommerce orders.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00316 · 23.2th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2026-01-16T06:43Z
EPSS history
Timeline
  • 16 JAN 06:43Z
    Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion
    cvelistv5