CVE-2026-92428: Unknown Rede Itaú For Woocommerce

Medium severity, CVSS 5.3. EPSS: 0.1% chance of exploitation in the next 30 days.

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.

Affected products

• Unknown Rede Itaú For Woocommerce: before 5.5.3 (fixed in 5.5.3)

Published 2026-10-15. Last modified 2026-10-15.