Description
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
Published: 2026-10-19
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 19 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Mon, 19 Oct 2026 10:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-862
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 19 Oct 2026 09:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-284

Mon, 19 Oct 2026 07:00:00 +0000

Type Values Removed Values Added
Description The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
Title Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: WPScan

Published:

Updated: 2026-10-19T09:31:20.467Z

Reserved: 2026-09-21T09:21:40.880Z

Link: CVE-2026-94272

cve-icon Vulnrichment

Updated: 2026-10-19T09:25:10.398Z

cve-icon NVD

Status : Received

Published: 2026-10-19T07:16:32.830

Modified: 2026-10-19T10:17:20.667

Link: CVE-2026-94272

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:15:06Z

Weaknesses