Threat Entry Updated 2026-04-15

CVE-2026-0942 - Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit Plugin

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs() function in all versions up to, and including, 5.1.5. This makes it possible for unauthenticated attackers to delete the Rede Order Logs metadata from all WooCommerce orders.

PLUGIN Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit

CVE-2026-0942

MEDIUM CVSS 5.3 2026-01-16

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-15

CVE-2026-0939 - Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit Plugin

The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including, 5.1.2. This is due to the plugin failing to verify the authenticity of payment callbacks. This makes it possible for unauthenticated attackers to manipulate WooCommerce order statuses, either marking unpaid orders as paid, or failed.

PLUGIN Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit

CVE-2026-0939

MEDIUM CVSS 5.3 2026-01-16

Risk Score

Open Full Technical Breakdown