Description
The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Rede Itaú for WooCommerce | < 5.5.3 | 5.5.3 |
References
- https://wpscan.com/vulnerability/106c8da0-cfb5-49da-8c6d-cb56e8cbc4c2/ exploit vdb-entry technical-description