Live › vulnerability › CVE-2026-100145
Go to dashboardThe Synchrony Financing WordPress plugin before 1.1.2 has a REST route that modifies WooCommerce orders without checking authorisation. An unauthenticated attacker can reassign any order to an account they control, change its details, and read the customer's personal data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Synchrony Financing WordPress plugin earlier than 1.1.2 with WooCommerce are exposed, because the flawed route acts on live order records. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
wp plugin get synchrony-financing --field=version (plugin slug unknown from sources; confirm it).wp eval 'print_r(array_keys(rest_get_server()->get_routes()));' and check for a route that updates WooCommerce orders.1.1.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
This page as .md · .json · in your agent: get_signal("CVE-2026-100145")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.