CVE-2026-94273

MediumCVSS 5.3

Published: 19/10/2026(UTC)Updated: 19/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid. This allows unauthenticated attackers to mark arbitrary orders as paid without completing payment.

Risk Assessment

An attacker can mark orders as paid without payment, leading to financial loss and falsified order status. The risk affects WooCommerce stores using this plugin.

Recommendation

Update the Snap Finance plugin to a version later than 3.11.0. Review order history for unauthorized payment status changes.

Other vulnerabilities in Snap Finance WordPress plugin

CVE-2026-94272Medium
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorized source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.

Original NVD description (English source)

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS