CVE-2026-0942
📋 TL;DR
This vulnerability allows unauthenticated attackers to delete payment metadata logs from all WooCommerce orders using the Rede Itaú plugin. Any WordPress site running the vulnerable plugin version is affected, potentially disrupting payment reconciliation and audit trails.
💻 Affected Systems
- Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Complete loss of payment transaction logs for all orders, making financial reconciliation impossible and potentially hiding fraudulent activity.
Likely Case
Partial deletion of payment metadata causing operational disruption for merchants trying to reconcile payments and investigate transactions.
If Mitigated
No impact if plugin is patched or proper access controls prevent unauthorized API calls.
🎯 Exploit Status
The vulnerability is simple to exploit via direct HTTP requests to the vulnerable endpoint without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.1.3 or later
Vendor Advisory: https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.3/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'Rede Itaú for WooCommerce'. 4. Click 'Update Now' if available, or download version 5.1.3+ from WordPress repository. 5. Activate the updated plugin.
🔧 Temporary Workarounds
Disable vulnerable endpoint via .htaccess
linuxBlock access to the vulnerable WordPress endpoint that triggers the clearOrderLogs function.
# Add to .htaccess in WordPress root directory
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/lkn-integration-rede-for-woocommerce/v1/clear-order-logs$
RewriteRule .* - [F,L]
</IfModule>
Deactivate plugin temporarily
linuxTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate woo-rede
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to the vulnerable endpoint /wp-json/lkn-integration-rede-for-woocommerce/v1/clear-order-logs
- Restrict access to WordPress REST API endpoints using authentication or IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for 'Rede Itaú for WooCommerce' version 5.1.2 or earlier.Check Version:
wp plugin get woo-rede --field=versionVerify Fix Applied:
Verify plugin version is 5.1.3 or later in WordPress admin panel, and test that unauthorized requests to the clear-order-logs endpoint return proper authentication errors.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to POST /wp-json/lkn-integration-rede-for-woocommerce/v1/clear-order-logs from unauthenticated users
- Sudden absence of 'rede_order_logs' metadata in WooCommerce order records
Network Indicators:
- Unusual volume of requests to WordPress REST API endpoints from unauthenticated sources
- POST requests to clear-order-logs endpoint without authentication headers
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-json/lkn-integration-rede-for-woocommerce/v1/clear-order-logs" AND http_status=200 AND NOT user_authenticated=true)🔗 References
- https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L42
- https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L58
- https://www.wordfence.com/threat-intel/vulnerabilities/id/4927c060-f2b2-4916-b049-1442bba63e98?source=cve
