CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Rede Itaú for WooCommerce plugin for WordPress is vulnerable to order status manipulation due to insufficient verification of data authenticity in all versions up to, and including, 5.1.2. This is due to the plugin failing to verify the authenticity of payment callbacks. This makes it possible for unauthenticated attackers to manipulate WooCommerce order statuses, either marking unpaid orders as paid, or failed.
Explanation of Vulnerability in Simple Terms
The Rede Itaú for WooCommerce payment plugin contains an integrity vulnerability affecting versions up to 5.1.2. An attacker on the network can modify data in transit without authentication or user interaction. The vulnerability does not expose sensitive information or disrupt service availability, but allows tampering with payment-related communications or transaction details.
What an attacker can do
Modify payment data or transaction information in transit without authentication.
Potential impact on your site
Payment transactions or order data could be altered by an attacker, potentially affecting order integrity and customer trust.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
