Description

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-19T07:16:34.200Z",
  "pubdate": "2026-09-19T07:16:34.200Z",
  "executiveSummary": "The Rede Itaú for WooCommerce plugin (before version 5.4.7) contains a critical authentication bypass vulnerability in its PIX payment processing webhook.\nThis vulnerability allows unauthenticated remote attackers to trigger order status transitions, specifically marking pending orders as 'paid' without performing the corresponding financial transaction.\nThe root cause is a failure to verify the authenticity or origin of incoming webhook requests, effectively trusting arbitrary HTTP POST requests that mimic legitimate payment notifications.\nThe impact is significant, as it enables unauthorized acquisition of goods or services, leading to direct financial loss for merchants.\nNo authentication or elevated privileges are required for exploitation, as the webhook endpoint is accessible via standard network requests.\nThe vulnerability poses a high risk to store integrity and revenue, requiring immediate updates to the patched version.",
  "technicalDetails": "The vulnerability resides within the PIX payment notification handling logic of the Rede Itaú for WooCommerce plugin. In affected versions prior to 5.4.7, the webhook endpoint intended to receive asynchronous payment status updates from the payment gateway fails to implement necessary cryptographic verification or origin validation checks.\nTypically, payment gateways provide secure mechanisms to verify that a notification was legitimately sent by the gateway, such as HMAC signatures or IP whitelisting. In this instance, the plugin treats incoming POST requests to the webhook URL as trusted data.\nAn attacker can exploit this by crafting a malicious HTTP request that mimics the expected schema of the Rede Itaú PIX payment response. By iterating through or guessing the WooCommerce order ID, the attacker sends a request payload directly to the plugin's webhook listener. The plugin, failing to validate the request integrity, parses the parameters and proceeds to execute the function responsible for updating the WooCommerce order status to 'Processing' or 'Completed'.\nThe attack flow follows these steps: 1. Identification of the target merchant's publicly accessible webhook URL associated with the plugin. 2. Creation of a pending order by the attacker on the WooCommerce store. 3. Sending an unauthorized POST request to the plugin's webhook listener with parameters reflecting a successful payment for the specific Order ID. 4. The server-side logic processes the request and updates the internal database status of the order. 5. The WooCommerce system triggers post-purchase workflows (e.g., granting access to digital goods, triggering shipment of physical items).\nThis behavior is possible because the endpoint is globally accessible and lacks a non-repudiation mechanism, allowing any remote party to force the application state change. Post-exploitation, the merchant has no record of receiving actual funds, but the system indicates the transaction is settled, leading to successful inventory theft or service fraud without the knowledge of the site administrator."
}