5.3
Medium
CVE-2026-92430 The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the…
Description
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit 3.6 | 3.6.1 → < 5.4.7 | 5.4.7 |