CVE-2026-92428CWE-345

CVE-2026-92428

Medium · published October 15, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
1.4
In the wild
Unconfirmed
What it is

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00114 · 1.4th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2026-10-15T11:18Z
References (1)
https://wpscan.com/vulnerability/106c8da0-cfb5-49da-8c6d-cb56e8cbc4c2/ · [email protected]
EPSS history
Timeline
  • 16 OCT 03:33Z
    EPSS moved — → 0%
    epss
  • 15 OCT 06:41Z
    Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook
    cvelistv5
  • 15 OCT 06:41Z
    Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Failure Webhook
    cvelistv5