What is GHSA-fgw2-qjhx-x8qq?

GHSA-fgw2-qjhx-x8qq is a security advisory published by GitHub Security Advisories with Medium severity. The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a...

Which CVE IDs does GHSA-fgw2-qjhx-x8qq cover?

GHSA-fgw2-qjhx-x8qq covers the following CVE IDs: CVE-2026-92428. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-fgw2-qjhx-x8qq?

GHSA-fgw2-qjhx-x8qq has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-fgw2-qjhx-x8qqMediumCVSS 5.3

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a...

Vendor

GitHub Security Advisories

Published

October 15, 2026

Last Modified

October 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-92428 →

📋 Description

The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an order's status, allowing unauthenticated attackers to change the status of arbitrary WooCommerce orders, including orders that were already paid or completed.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-92428
https://wpscan.com/vulnerability/106c8da0-cfb5-49da-8c6d-cb56e8cbc4c2
https://github.com/advisories/GHSA-fgw2-qjhx-x8qq