CVE-2026-94273
CVE-2026-94273 · Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.
CVSS 5.3 · Medium · EPSS 0.2%
- Published
- Updated
Affected products and versions
snap finance
- Versions
- ≥ 0, ≤ 3.11.0: Affected (semver)
No fix published