CVE-2026-92430

{"id": "CVE-2026-92430", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92430", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-19T13:10:31.173852Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit", "versions": [{"status": "affected", "version": "3.6.1", "lessThan": "5.4.7", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-19T07:16:34.200", "references": [{"url": "https://wpscan.com/vulnerability/1f1d7de5-cb7c-4440-b998-c6f15ecc6b4c/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "The Rede Ita\u00fa for WooCommerce \u2014 Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook before updating an order's status, allowing unauthenticated attackers to mark a pending order as paid without paying."}], "lastModified": "2026-09-21T13:34:57.127", "sourceIdentifier": "contact@wpscan.com"}