CVE-2026-92430: Rede Itaú WooCommerce Auth Bypass Flaw

CVE-2026-92430 Overview

CVE-2026-92430 is a missing authorization vulnerability [CWE-862] in the Rede Itaú for WooCommerce plugin for WordPress. The plugin provides PIX, credit card, and debit payment integration for Brazilian merchants using Itaú's Rede payment gateway. Versions prior to 5.4.7 do not verify the authenticity of incoming PIX payment webhooks before updating an order's status. An unauthenticated remote attacker can send a forged webhook request to the WordPress site and mark a pending order as paid without any funds being transferred. The flaw affects merchants who accept PIX payments through this plugin.

Critical Impact

Unauthenticated attackers can mark pending WooCommerce orders as paid, resulting in fulfillment of unpaid goods or services.

Affected Products

• Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin
• All plugin versions prior to 5.4.7
• WordPress sites running WooCommerce with the Rede Itaú plugin installed

Discovery Timeline

• 2026-09-19 - CVE-2026-92430 published to the National Vulnerability Database
• 2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-92430

Vulnerability Analysis

The vulnerability resides in the PIX payment webhook handler exposed by the Rede Itaú plugin. When a customer initiates a PIX payment, the plugin registers a public endpoint that receives asynchronous notifications from the payment provider. The endpoint updates the associated WooCommerce order status based on the payload it receives. The plugin does not validate that the incoming request originated from the legitimate Rede Itaú webhook infrastructure. It also does not verify a signature, shared secret, or source authenticity before mutating order state.

Any remote actor who can reach the WordPress site over HTTP can therefore submit crafted webhook payloads. By referencing a known or guessable order identifier, the attacker instructs the plugin to transition a pending order to a paid state. Once the order is marked paid, downstream WooCommerce automation may release digital goods, generate shipping labels, or trigger fulfillment workflows.

Root Cause

The root cause is a missing authorization check on the PIX webhook route [CWE-862]. The handler processes payloads without confirming the caller possesses a valid credential or that the payload carries a valid provider-issued signature.

Attack Vector

Exploitation requires network access to the WordPress site and no authentication or user interaction. An attacker enumerates or guesses a pending order identifier, then issues an HTTP request to the plugin's webhook URL with a payload indicating successful payment. The plugin updates the order status, completing the business-logic bypass. See the WPScan Vulnerability Report for additional context.

Detection Methods for CVE-2026-92430

Indicators of Compromise

• Orders transitioning from pending to processing or completed without a corresponding transaction record in the Rede Itaú merchant portal.
• Inbound HTTP POST requests to the plugin's PIX webhook endpoint from IP addresses outside Itaú's published webhook ranges.
• WooCommerce order notes indicating PIX payment confirmation without a matching bank settlement identifier.

Detection Strategies

• Reconcile WooCommerce order status changes against settlement reports from the Rede Itaú merchant dashboard on a daily cadence.
• Enable WordPress and web server access logging for the plugin webhook path and review for unexpected source IPs or high-volume POST activity.
• Alert on rapid state transitions where orders move from pending to completed within seconds of creation without customer session activity.

Monitoring Recommendations

• Forward WooCommerce order lifecycle events and web server logs to a centralized logging platform for correlation.
• Track fulfillment activity for orders paid via PIX and flag any orders completed without a matching bank confirmation identifier.
• Monitor for anomalous spikes in completed PIX orders, especially for high-value or digitally delivered products.

How to Mitigate CVE-2026-92430

Immediate Actions Required

• Update the Rede Itaú for WooCommerce plugin to version 5.4.7 or later on all affected WordPress sites.
• Audit recent PIX orders against Rede Itaú settlement reports and reverse fulfillment for any unmatched transactions.
• Restrict access to the plugin's webhook endpoint to Itaú's documented source IP ranges at the web server or WAF layer.

Patch Information

The vendor addressed the issue in version 5.4.7 of the Rede Itaú for WooCommerce plugin by adding authenticity verification for incoming PIX webhook requests. Site administrators should upgrade through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Report for the advisory reference.

Workarounds

• Deactivate the Rede Itaú plugin until the upgrade to 5.4.7 can be applied if PIX payments are not business critical.
• Enforce an IP allowlist at the web server, reverse proxy, or WAF that restricts the webhook path to Itaú's published notification source ranges.
• Require manual verification of PIX payment settlement in the merchant portal before fulfilling orders, disabling any automated fulfillment triggered by order status.

# Example nginx snippet restricting the plugin webhook path to trusted sources
location ~* /wc-api/rede-itau-pix { 
    allow 200.201.160.0/20;   # replace with Itau-published ranges
    deny all;
    proxy_pass http://wordpress_backend;
}