WordPress Security Bulletin: The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress (CVE-2026-0942)

Security Alert Summary

The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress contains a vulnerability that allows unauthorized deletion of Rede Order Logs metadata from WooCommerce orders due to a missing capability check on a function used to clear order logs. According to the CVE entry, unauthenticated attackers can trigger this behavior in affected versions up to and including 5.1.2.

CVE Details

• CVE ID: CVE-2026-0942
• Affected plugin / component: The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit plugin for WordPress (Rede Order Logs functionality)
• Affected versions: All versions up to, and including, 5.1.2
• Published: January 16, 2026 at 7:15:57 AM UTC
• Last modified: January 16, 2026 at 3:55:12 PM UTC
• CVSS v3.1: Base score 5.3 — MEDIUM
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
  • Attack vector: Network
  • Attack complexity: Low
  • Privileges required: None (unauthenticated)
  • User interaction: None
  • Scope: Unchanged
• Authentication / privileges / user interaction: Exploitable by unauthenticated attackers (no privileges required, no user interaction)
• Primary impact: Integrity impact: Low (deletion/modification of order log metadata). Confidentiality: None. Availability: None.
• CWE / weakness: CWE-306 (Missing Authentication for Critical Function)
• Fixed version: Not specified in the CVE entry

Technical Details

The CVE description indicates a missing capability check on the clearOrderLogs() function in the plugin. Because the function lacks proper access control, it can be invoked by unauthenticated parties, allowing deletion of the Rede Order Logs metadata attached to WooCommerce orders. The reported behavior affects all plugin versions through 5.1.2.

The consequence is a loss of integrity for order-related metadata: order logs that the plugin stores as metadata on WooCommerce orders can be removed by an attacker. The CVE description and referenced plugin source point to the integration endpoint implementation where the capability check is absent, enabling this operation without verifying the caller’s permissions.

This issue does not indicate disclosure of data (the CVSS confidentiality impact is NONE) and does not directly affect availability. The core technical problem is missing authorization checks on a function that performs deletion of order metadata.

How This Could Impact Your Website

Consider a typical site with a site owner, internal staff (store managers or customer support), and external contractors (developers or payment integrators). If an attacker can delete Rede order logs metadata, the store owner and staff may lose transaction-related records used for reconciliation, dispute resolution, or auditing. For example:

• The store owner may find order logs missing when investigating payment-related customer inquiries.
• Internal staff handling chargebacks or refunds could lack metadata needed to correlate payment events with orders.
• An external contractor performing integrations or troubleshooting could be unable to reproduce or diagnose issues due to missing logs.

While the CVE indicates no confidentiality impact (it does not report data disclosure), the removal of audit logs can hinder incident response and make it harder to detect or investigate other malicious activity. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.

Recommended Actions

• Update the affected plugin as soon as a patched version is available (the CVE entry does not specify a fixed version).
• Review and reduce unnecessary user roles and capabilities, especially for contributors and non-administrative accounts.
• Enforce strong passwords and two-factor authentication for editors and administrators.
• Remove unused or unmaintained plugins from your site.
• Monitor site activity and WooCommerce order metadata for unexpected deletions or unusual behavior.

If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.

References

• https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L42
• https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L58
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4927c060-f2b2-4916-b049-1442bba63e98?source=cve