CVE-2026-0942 describes a missing capability check in the clearOrderLogs() function of the Rede Itaú for WooCommerce plugin, which handles Payment PIX, Credit Card, and Debit transactions. This lack of authentication allows unauthenticated remote attackers to delete Rede Order Logs metadata associated with WooCommerce orders. The vulnerability affects all plugin versions up to and including 5.1.5. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker can delete order log metadata without authentication, potentially disrupting order tracking or auditing processes within WooCommerce. There is no direct confidentiality or availability impact reported. The integrity impact is limited to the deletion of order logs, which could hinder forensic or operational activities but does not directly compromise payment data or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's functions through other means, such as web application firewalls or custom access controls, to prevent unauthorized invocation of the clearOrderLogs() function. Monitor vendor channels for updates and apply patches promptly once available.