CVE-2026-0942: Data Modification in Rede Itaú WooCommerce

The core impact of CVE-2026-0942 lies in the ability of an attacker to tamper with order logs within a WooCommerce store. By deleting these logs, an attacker can effectively erase evidence of fraudulent transactions or other suspicious activities. This can hinder investigations, complicate dispute resolution, and potentially lead to financial losses for both the store owner and customers. The lack of authentication required to exploit this vulnerability significantly broadens the attack surface, as any unauthenticated user can trigger the log deletion.

1. Reserved2026-01-14
2. Published2026-01-16
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-0942 is to immediately upgrade the Rede Itaú for WooCommerce plugin to version 5.1.6 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a temporary workaround by restricting access to the clearOrderLogs() function. This could involve adding a capability check within the plugin code to ensure that only authorized users (e.g., administrators) can execute this function. Regularly audit your WordPress plugins for vulnerabilities and ensure they are kept up-to-date.

Active installs

1KKnown

Plugin rating