CVE-2026-92429: Rede Itaú WooCommerce Auth Bypass Flaw

CVE-2026-92429 Overview

CVE-2026-92429 affects the Rede Itaú for WooCommerce WordPress plugin in versions prior to 5.5.3. The plugin fails to verify the authenticity of incoming payment gateway webhooks before updating the status of a WooCommerce order. Unauthenticated remote attackers can send crafted webhook requests to the vulnerable endpoint and modify arbitrary order states. This includes marking unpaid orders as paid or cancelling completed orders. The flaw is categorized under CWE-345: Insufficient Verification of Data Authenticity.

Critical Impact

Unauthenticated attackers can tamper with the status of any WooCommerce order, enabling payment fraud and disruption of fulfillment workflows on affected e-commerce sites.

Affected Products

• Rede Itaú for WooCommerce WordPress plugin versions prior to 5.5.3
• WordPress sites running WooCommerce with the vulnerable plugin installed
• E-commerce storefronts integrating the Rede Itaú payment gateway through this plugin

Discovery Timeline

• 2026-10-15 - CVE-2026-92429 published to NVD
• 2026-10-15 - Last updated in NVD database

Technical Details for CVE-2026-92429

Vulnerability Analysis

The Rede Itaú for WooCommerce plugin exposes a webhook endpoint that receives payment status callbacks from the Rede Itaú payment gateway. The plugin processes these callbacks and updates the corresponding WooCommerce order record. The handler accepts incoming requests without validating that the message originated from the legitimate payment processor.

An attacker who can reach the webhook URL can submit forged payloads referencing arbitrary order identifiers. The plugin then applies the attacker-chosen status transition to the targeted order. This behavior allows unauthenticated manipulation of commerce state across the store.

Root Cause

The root cause is missing cryptographic or token-based verification of webhook authenticity. Payment gateway webhooks typically require signature validation using a shared secret (such as an HMAC header) or verification of the sender's identity. The affected plugin omits this check and trusts the request payload directly. This maps to CWE-345: Insufficient Verification of Data Authenticity.

Attack Vector

Exploitation requires only network access to the WordPress site. No authentication, user interaction, or elevated privileges are needed. An attacker sends an HTTP request to the plugin's webhook endpoint containing a target order identifier and the desired status. The server-side handler updates the order without challenge. See the WPScan Vulnerability Database Entry for additional technical details.

No verified public proof-of-concept code is available at this time. The attack technique described above reflects the behavior disclosed in the public advisory.

Detection Methods for CVE-2026-92429

Indicators of Compromise

• Unexpected status transitions on WooCommerce orders, particularly pending or on-hold orders moving to processing or completed without a matching gateway transaction record.
• Completed orders transitioning to cancelled without administrator action or customer request.
• Inbound HTTP POST requests to the plugin's Rede Itaú webhook endpoint from source IP addresses outside the expected payment gateway ranges.

Detection Strategies

• Reconcile WooCommerce order status changes against authoritative transaction logs from the Rede Itaú gateway to identify discrepancies.
• Enable WordPress audit logging to capture order status mutations along with the originating request source and user context.
• Deploy web application firewall (WAF) rules that flag unauthenticated POST requests targeting the plugin's callback endpoint.

Monitoring Recommendations

• Monitor web server access logs for high-frequency or sequential requests enumerating order IDs against the webhook URL.
• Alert on order status changes performed with no associated authenticated administrator session or legitimate customer checkout flow.
• Track anomalies in order fulfillment metrics, such as sudden spikes in completed-but-unpaid orders.

How to Mitigate CVE-2026-92429

Immediate Actions Required

• Update the Rede Itaú for WooCommerce plugin to version 5.5.3 or later on all affected WordPress sites.
• Audit recent order status changes to identify any transitions that may have resulted from exploitation.
• Reconcile store financial records against payment gateway settlement reports for the exposure window.

Patch Information

The vendor has addressed the issue in Rede Itaú for WooCommerce version 5.5.3. Site administrators should upgrade through the WordPress plugin management console or by replacing the plugin files with the fixed release. Refer to the WPScan Vulnerability Database Entry for advisory details.

Workarounds

• Restrict access to the plugin's webhook endpoint using IP allowlisting at the web server or WAF layer, permitting only published Rede Itaú gateway source ranges.
• Temporarily disable the Rede Itaú for WooCommerce plugin on stores that cannot patch immediately and route payments through an alternative integration.
• Add server-level request logging on the webhook path to retain forensic evidence until the patched version is deployed.

# Example: restrict webhook endpoint access via Nginx to known gateway IPs
location ~* /wc-api/rede_itau_webhook {
    allow 192.0.2.0/24;    # Replace with Rede Itaú published IP ranges
    deny all;
    try_files $uri $uri/ /index.php?$args;
}