CVE-2026-92429Medium· 5.3▾ SunlitThe Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including marking unpaid orders as paid and cancelling completed orders.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92428Medium· 5.3The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce…
CVE-2025-31356NoneInsufficient verification of data authenticity for some Intel(R) Trust Domain Extensions (Intel(R) TDX) within Ring 0: Hypervisor may allow an information disclosure
CVE-2026-103324Medium· 5.3The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notifications it receives, as the secret used to sign them is empty by default, allowing unauthenticated…
CVE-2026-104108High· 8.1FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations
CVE-2026-102682Medium· 5.6Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents
CVE-2026-102695High· 8.2OmniFaces is a utility library for Faces