Executive brief
The Rede Itaú for WooCommerce plugin handles payment processing for WordPress-based online stores, accepting PIX, credit card, and debit card payments. The plugin fails to verify that payment confirmation webhooks are genuine, allowing an attacker to forge a fake payment confirmation and mark any order as paid without actually processing payment. This could result in fraudulent orders being fulfilled while the merchant receives no actual payment.
Technical details
The vulnerability is a missing authentication check in the PIX payment webhook handler (CWE-862: Missing Authorization). An unauthenticated attacker can send a crafted webhook request to the plugin's callback endpoint to update an order status to "paid" without providing valid payment credentials or signatures. The attack requires network access to the webhook endpoint but no prior authentication or user interaction. A fix is available in version 5.4.7 and later.
Affected products
- Rede Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit before 5.4.7
Timeline
- 2026-09-19: disclosed
- 2026-09-19: patched: Fixed in version 5.4.7