CVE-2026-0942

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-0942", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-14T15:02:25.916Z", "datePublished": "2026-01-16T06:43:20.555Z", "dateUpdated": "2026-04-08T16:50:25.135Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:25.135Z"}, "affected": [{"vendor": "linknacional", "product": "Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.1.5", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs() function in all versions up to, and including, 5.1.5. This makes it possible for unauthenticated attackers to delete the Rede Order Logs metadata from all WooCommerce orders."}], "title": "Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4927c060-f2b2-4916-b049-1442bba63e98?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L42"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L58"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "timeline": [{"time": "2026-01-01T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-01-28T17:25:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-15T18:31:18.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-16T13:58:38.603695Z", "id": "CVE-2026-0942", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T13:58:49.102Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-0942", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-16T13:58:38.603695Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-16T13:58:44.979Z"}}], "cna": {"title": "Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion", "credits": [{"lang": "en", "type": "finder", "value": "Osvaldo Noe Gonzalez Del Rio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "linknacional", "product": "Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.1.5"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-01T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-01-28T17:25:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-15T18:31:18.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4927c060-f2b2-4916-b049-1442bba63e98?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L42"}, {"url": "https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L58"}], "descriptions": [{"lang": "en", "value": "The Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs() function in all versions up to, and including, 5.1.5. This makes it possible for unauthenticated attackers to delete the Rede Order Logs metadata from all WooCommerce orders."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:25.135Z"}}}, "cveMetadata": {"cveId": "CVE-2026-0942", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:25.135Z", "dateReserved": "2026-01-14T15:02:25.916Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-16T06:43:20.555Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit", "vendor": "linknacional", "versions": [{"lessThanOrEqual": "5.1.5", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clearOrderLogs() function in all versions up to, and including, 5.1.5. This makes it possible for unauthenticated attackers to delete the Rede Order Logs metadata from all WooCommerce orders."}, {"lang": "es", "value": "El plugin Rede Ita\u00fa para WooCommerce \u2014 Pago PIX, Tarjeta de Cr\u00e9dito y D\u00e9bito para WordPress es vulnerable a la modificaci\u00f3n no autorizada de datos debido a una falta de verificaci\u00f3n de capacidad en la funci\u00f3n clearOrderLogs() en todas las versiones hasta la 5.1.2, inclusive. Esto hace posible que atacantes no autenticados eliminen los metadatos de los Registros de Pedidos de Rede de todos los pedidos de WooCommerce."}], "id": "CVE-2026-0942", "lastModified": "2026-06-17T10:11:39.587", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-0942", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-16T13:58:38.603695Z", "version": "2.0.3"}}]}, "published": "2026-01-16T07:15:57.030", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L42"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/woo-rede/tags/5.1.2/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php#L58"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4927c060-f2b2-4916-b049-1442bba63e98?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T19:11:11.509884+00:00", "value": {"mitigation_remediation": ["Install the latest version of the plugin (5.1.6 or newer) which includes a capability check for the clearOrderLogs function", "If an immediate update is not possible, remove or disable the clearOrderLogs endpoint from the plugin to prevent unauthenticated access", "Back up existing order metadata and monitor the logs for any unexpected deletions to detect potential exploitation"], "summary": {"action": "Update Plugin", "impact": "Unauthorized Order Log Deletion"}, "threat_synthesis": {"affected_systems": "The issue affects the WordPress plugin Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit, provided by linknacional. Versions up to and including 5.1.5 are vulnerable; any site using these releases is at risk.", "description_and_impact": "The vulnerability exists because the clearOrderLogs() function in the Rede Ita\u00fa for WooCommerce plugin does not perform a capability check. This omission allows an attacker who does not have any authenticated access to the WordPress site to invoke the function and remove the Rede Order Logs metadata from all WooCommerce orders. The loss of these logs erodes the ability to audit transactions and could conceal fraudulent activity. The weakness is a missing authentication for a critical function (CWE\u2011306).", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate risk level. With an EPSS score of less than 1\u202f%, the probability of exploitation is considered low, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker can exploit the flaw by sending an unauthenticated request to the clearOrderLogs endpoint; no special privileges or additional infrastructure are required."}}}}, "created": "2026-01-16T13:41:40.149533+00:00", "updated": "2026-04-15T19:15:12.082566+00:00", "vendors": ["linknacional", "linknacional$PRODUCT$rede_itau_for_woocommerce", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}