Answer in brief
CVE-2026-92430 records a Medium severity (CVSS 5.3) vulnerability in Rede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook. The current sources do not mark it as known exploited. The current feed maps Unknown/Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.3. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Unknown/Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Unknown/Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debitgeneric | >=3.6.1 <5.4.7 | 5.4.7 |
Published upstream
Sep 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 21, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 19, 2026
The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying.
Quoted source text, attributed separately from HOL analysis.