CVE-2026-94272

MediumCVSS 5.3

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorized source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.

Risk Assessment

An unauthenticated attacker can change order statuses, potentially leading to financial losses or disruption of the sales process. It may also compromise the integrity of order data.

Recommendation

Update the Snap Finance plugin to version 3.12.0 or later. Until then, consider disabling the plugin or implementing additional request verification.

Other vulnerabilities in Snap Finance WordPress plugin

CVE-2026-94273Medium
The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid. This allows unauthenticated attackers to mark arbitrary orders as paid without completing payment.

Original NVD description (English source)

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS