CVE-2026-92429— Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook
Quick assessment
Affected
Unknown Rede Itaú for WooCommerce
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WooCommerce WordPress 插件 Rede Itaú 在 5.5.3 版本之前存在安全漏洞。该插件在更新订单状态前，未对支付网关的网络钩子（webhook）真实性进行验证。这一缺陷允许未经身份认证的攻击者修改任意 WooCommerce 订单的状态，包括将未付款订单标记为已付款，以及取消已完成状态的订单。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | Rede Itaú for WooCommerce | 3.7.1< 5.5.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92429
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Rede Itaú for WooCommerce 3.7.1 - 5.5.2 - Unauthenticated Order Status Manipulation via maxiPago Debit Webhook
Source: CVE Program / CVE List V5
Vulnerability Description
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | Rede Itaú for WooCommerce | 3.7.1 ~ 5.5.3 | - |
|
II. Public POCs for CVE-2026-92429
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92429
请登录查看更多情报信息。
Same Patch Batch · Unknown · 2026-10-15 · 9 CVEs total
| CVE-2026-92428 | 5.3 MEDIUM | Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order Status Manipulation via 3DS Fail |
| CVE-2026-103324 | 5.3 MEDIUM | Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Unauthenticated Arbitrary Order |
| CVE-2026-96537 | Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite | |
| CVE-2026-74920 | Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute | |
| CVE-2026-109145 | User Rights Access Manager <= 1.1.3 - Unauthenticated Privilege Escalation via AJAX Regist | |
| CVE-2026-106031 | Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result | |
| CVE-2026-104643 | Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide UR | |
| CVE-2026-103304 | eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-92428
Rede Itaú for WooCommerce < 5.5.3 - Unauthenticated Order St -
CVE-2026-103324
Cardinity Payment Gateway for WooCommerce 3.2.6 - 3.4.1 - Un -
CVE-2026-96537
Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish -
CVE-2026-74920
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode -
CVE-2026-109145
User Rights Access Manager <= 1.1.3 - Unauthenticated Privil
V. Comments for CVE-2026-92429
No comments yet