CVE-2026-94261
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.
Risk Assessment
Attackers can falsely confirm payments for arbitrary orders, leading to financial losses and compromising order integrity.
Recommendation
Update the Sifalo Pay plugin to version 2.5.3 or later, which includes the fix.
Other vulnerabilities in Sifalo Pay WordPress plugin
Original NVD description (English source)
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS