CVE-2026-92429
Last modified
CVE-2026-92429 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.. EPSS estimates a 0.11% chance of exploitation in the next 30 days.
Description
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Rede Itaú for WooCommerce | >= 3.7.1, < 5.5.3 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92429?
How severe is CVE-2026-92429?
How do I fix CVE-2026-92429?
How Strix Helps
- Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92423The Meow Gallery WordPress plugin before 5.5.5 does not perf…2.7
- CVE-2026-92424The Content Egg WordPress plugin before 11.9.0 does not ver…6.8
- CVE-2026-92425The Hydra Booking — Appointment Scheduling & Booking Calenda…5.5
- CVE-2026-92426The YITH WooCommerce Popup WordPress plugin before 1.60.0 do…4.9
- CVE-2026-92427The Coinsnap Bitcoin Crowdfunding WordPress plugin through 1…5.3
- CVE-2026-92428The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 …5.3
- CVE-2026-9243The Plus Addons for Elementor plugin for WordPress is vulner…6.4
- CVE-2026-92430The Rede Itaú for WooCommerce — Payment PIX, Credit Card and…5.3
- CVE-2026-92431The Patreon WordPress plugin before 1.10.0 does not perform …3.7
- CVE-2026-92432The Patreon WordPress plugin before 1.10.0 does not validate…4.3
- CVE-2026-92433The Patreon WordPress plugin before 1.10.0 does not verify a…6.5
- CVE-2026-92435The Mailchimp for WooCommerce WordPress plugin before 6.1.1 …5.3
Are you affected by CVE-2026-92429?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST