CVE-2026-0942: Rede Itaú WooCommerce Auth Bypass Flaw

CVE-2026-0942 Overview

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress contains a Missing Authentication for Critical Function vulnerability (CWE-306) that allows unauthorized modification of data. The vulnerability exists due to a missing capability check on the clearOrderLogs() function in all versions up to, and including, 5.1.2. This security flaw enables unauthenticated attackers to delete the Rede Order Logs metadata from all WooCommerce orders.

Critical Impact

Unauthenticated attackers can remotely delete payment order logs from all WooCommerce orders, potentially destroying audit trails and payment transaction records critical for business operations and compliance.

Affected Products

• Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin versions up to and including 5.1.2
• WordPress sites using the vulnerable woo-rede plugin
• WooCommerce stores with Rede payment integration enabled

Discovery Timeline

• January 16, 2026 - CVE-2026-0942 published to NVD
• January 16, 2026 - Last updated in NVD database

Technical Details for CVE-2026-0942

Vulnerability Analysis

This vulnerability represents a Broken Access Control flaw where the clearOrderLogs() function lacks proper authorization checks before executing its data modification operations. The function, located in LknIntegrationRedeForWoocommerceWcEndpoint.php, can be invoked by any user without verifying whether they have the necessary permissions to perform such actions. This allows unauthenticated remote attackers to execute administrative functions that should only be accessible to authorized store administrators.

The impact of this vulnerability is primarily data integrity loss, as attackers can systematically delete order log metadata across the entire WooCommerce installation. While the vulnerability does not directly expose sensitive payment information or allow for financial fraud, the deletion of payment logs can significantly impact business operations, compliance auditing, and troubleshooting capabilities.

Root Cause

The root cause of this vulnerability is the absence of a capability check (such as current_user_can()) within the clearOrderLogs() function implementation. In WordPress plugin development, sensitive functions that modify or delete data should always verify that the requesting user has appropriate permissions before proceeding with the operation. The vulnerable code at line 42 and line 58 of the endpoint file fails to implement these essential authorization controls.

Attack Vector

The vulnerability is exploitable via the network with no authentication required. An attacker can send crafted HTTP requests directly to the WordPress site targeting the vulnerable endpoint. The attack requires no user interaction and can be executed with low complexity. The exploitation path involves:

1. Identifying WordPress sites running the vulnerable Rede Itaú for WooCommerce plugin
2. Crafting requests to invoke the clearOrderLogs() function directly
3. Successfully deleting Rede Order Logs metadata without any authentication

The vulnerability can be exploited by directly calling the exposed endpoint that handles the clearOrderLogs() function. Without proper capability checks, the function processes the request regardless of the caller's authentication status, resulting in the deletion of order log metadata across all WooCommerce orders.

Detection Methods for CVE-2026-0942

Indicators of Compromise

• Unexpected HTTP requests targeting the woo-rede plugin endpoint paths, particularly those invoking log clearing functions
• Missing or unexpectedly empty Rede Order Logs metadata in WooCommerce orders
• Web server logs showing anonymous requests to LknIntegrationRedeForWoocommerceWcEndpoint.php
• Database audit logs indicating bulk deletion of _rede_order_log post metadata

Detection Strategies

• Implement web application firewall (WAF) rules to monitor and alert on requests to the vulnerable plugin endpoint
• Deploy file integrity monitoring on WordPress plugin directories to detect unauthorized changes
• Configure database query logging to identify bulk DELETE operations on WooCommerce order metadata
• Use WordPress security plugins to monitor unauthenticated API calls to plugin endpoints

Monitoring Recommendations

• Enable detailed access logging on web servers to capture all requests to WordPress plugin paths
• Implement real-time alerting for database changes to WooCommerce order metadata tables
• Monitor for repeated requests to woo-rede endpoint files from single IP addresses or unusual patterns
• Review WordPress admin logs for unauthorized administrative actions

How to Mitigate CVE-2026-0942

Immediate Actions Required

• Update the Rede Itaú for WooCommerce plugin to a version newer than 5.1.2 that includes the security fix
• Temporarily disable the plugin if an update is not immediately available
• Implement WAF rules to block unauthenticated access to the vulnerable endpoint
• Back up existing WooCommerce order data and Rede payment logs

Patch Information

Users should update the Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin to the latest version available from the WordPress plugin repository. The vulnerability affects all versions up to and including 5.1.2. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Restrict access to the plugin's endpoint file using .htaccess rules or server configuration to require authentication
• Implement a custom WordPress must-use plugin that adds capability checks to the vulnerable function
• Use a security plugin to enforce authentication on all plugin AJAX endpoints
• Deploy a reverse proxy or WAF rule to filter unauthenticated requests to the affected endpoint path

# Example .htaccess restriction for vulnerable endpoint
# Add to WordPress root .htaccess file
<Files "LknIntegrationRedeForWoocommerceWcEndpoint.php">
    Order Deny,Allow
    Deny from all
    # Allow only authenticated admin requests via WordPress
</Files>