CVE-2026-94260

MediumCVSS 5.3

Published: 14/10/2026(UTC)Updated: 14/10/2026(UTC)Translated: 14/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

5th percentile - higher than 5% of all known CVEs

Summary

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state.

Risk Assessment

Attackers can manipulate order data and force failures, leading to operational disruptions and potential financial losses.

Recommendation

Update the Sifalo Pay plugin to version 2.5.3 or later, which includes the fix.

Other vulnerabilities in Sifalo Pay WordPress plugin

CVE-2026-94261Medium
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS