🔐 CVE Alert

CVE-2026-0939

MEDIUM 5.3

Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.2 - Unauthenticated Order Status Manipulation

CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th

The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including, 5.1.2. This is due to the plugin failing to verify the authenticity of payment callbacks. This makes it possible for unauthenticated attackers to manipulate WooCommerce order statuses, either marking unpaid orders as paid, or failed.

CWE CWE-345
Vendor linknacional
Product rede itaú for woocommerce — payment pix, credit card and debit
Published Jan 16, 2026
Last Updated Apr 8, 2026
Stay Ahead of the Next One

Get instant alerts for linknacional rede itaú for woocommerce — payment pix, credit card and debit

Be the first to know when new medium vulnerabilities affecting linknacional rede itaú for woocommerce — payment pix, credit card and debit are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability

Affected Versions

linknacional / Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
0 ≤ 5.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗
wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/722c666b-913f-4289-82e6-30aa0a3abc2b?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L45 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L460 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L710 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3441046/woo-rede/tags/5.1.3/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php

Credits

Osvaldo Noe Gonzalez Del Rio