CVE-2026-92428
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 15, 2026
Vendor
unknown
Description
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.