CVE WATCH / VULNERABILITY DETAIL
CVE-2026-92428
MEDIUMCVSS 5.3NVD feed
Published 15 October 2026 · tracked since 16 October 2026
Description
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-110924 MEDIUM 4.8
- CVE-2026-110927 MEDIUM 4.3
- CVE-2026-106160 MEDIUM 5.4
- CVE-2026-99999 CRITICAL 9.3
- CVE-2026-110723 HIGH 7.5
- CVE-2026-109686 CRITICAL 9.8
- CVE-2026-107416 HIGH 7.5
- CVE-2026-8145 MEDIUM 5.4
- CVE-2026-110726 MEDIUM 6.5
- CVE-2026-79824 HIGH 8