CVE-2026-94272
CVE-2026-94272 · Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
CVSS 5.3 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
snap finance
- Versions
- ≥ 1.0.8, < 3.12.0: Affected (semver)
Update to 3.12.0