CVE-2026-0939 is a vulnerability in the Rede Itaú for WooCommerce plugin that arises from insufficient verification of data authenticity in payment callbacks. This weakness (CWE-345) enables unauthenticated attackers to manipulate WooCommerce order statuses, such as marking unpaid orders as paid or failed. The issue affects all versions up to 5.1.2 and has a CVSS 3.1 base score of 5.3, indicating a medium severity. No known exploits are reported in the wild, and no patch or remediation details have been provided by the vendor.

The vulnerability allows attackers to alter order statuses without authentication, potentially causing financial discrepancies by marking unpaid orders as paid or failing legitimate payments. This can disrupt business operations and payment reconciliation but does not directly impact confidentiality or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor for vendor updates and consider implementing additional verification controls on payment callbacks if possible.