{"id":"CVE-2026-100145","kind":"vulnerability","aliases":["CVE-2026-100145"],"related":[],"title":"Synchrony Financing WordPress plugin: unauthenticated REST route alters WooCommerce orders","description":"The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.","summary":"The Synchrony Financing WordPress plugin before 1.1.2 has a REST route that modifies WooCommerce orders without checking authorisation. An unauthenticated attacker can reassign any order to an account they control, change its details, and read the customer's personal data.","severity":"medium","cvss":6.5,"epss":0.00209,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","woocommerce","wordpress"],"not_affected_if":["plugin-1.1.2-or-later","plugin-not-installed"],"how_to_check":"- Check the installed version of the Synchrony Financing plugin in the WordPress admin plugins list, or run `wp plugin get synchrony-financing --field=version` (plugin slug unknown from sources; confirm it).\n- Look for the plugin's REST routes with `wp eval 'print_r(array_keys(rest_get_server()->get_routes()));'` and check for a route that updates WooCommerce orders.","fix":"- Update the Synchrony Financing WordPress plugin to `1.1.2` or later.\n- If you cannot update yet, deactivate the plugin until the update is applied.","status":"open","published_at":"2026-10-21T06:16:44+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:49:10+00:00","updated_at":"2026-10-25T03:49:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:49:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Synchrony Financing WordPress plugin to `1.1.2` or later.\n- If you cannot update yet, deactivate the plugin until the update is applied.","reach":"internet","title":"Synchrony Financing WordPress plugin: unauthenticated REST route alters WooCommerce orders","impact":"medium","summary":"The Synchrony Financing WordPress plugin before 1.1.2 has a REST route that modifies WooCommerce orders without checking authorisation. An unauthenticated attacker can reassign any order to an account they control, change its details, and read the customer's personal data.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker reassigns orders and reads customer personal data","analyst_note":"","how_to_check":"- Check the installed version of the Synchrony Financing plugin in the WordPress admin plugins list, or run `wp plugin get synchrony-financing --field=version` (plugin slug unknown from sources; confirm it).\n- Look for the plugin's REST routes with `wp eval 'print_r(array_keys(rest_get_server()->get_routes()));'` and check for a route that updates WooCommerce orders.","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-1.1.2-or-later"],"who_is_affected":"Sites running the Synchrony Financing WordPress plugin earlier than 1.1.2 with WooCommerce are exposed, because the flawed route acts on live order records. Sites that do not run this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000637,"input_tokens":3359,"output_tokens":602,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-100145':13A,16A '-2026':12A,15A '1.1.2':27B,67C 'account':48B,92C 'allow':83C 'alter':8A 'associ':102C 'attack':41B,85C 'authoris':38B,71C 'chang':51B 'check':37B 'control':50B,94C 'custom':57B,103C 'cve':11A,14A 'data':60B,106C 'detail':53B,98C 'ecommerc':17B 'financ':2A,23B,63C 'modifi':33B,80C 'one':74C 'order':10A,35B,45B,82C,89C 'packag':18B 'person':59B,105C 'plugin':4A,25B,65C 'proper':70C 'read':55B,100C 'reassign':43B,87C 'request':72C 'rest':6A,30B,77C 'rout':7A,31B,78C 'synchroni':1A,22B,62C 'tamper':95C 'unauthent':5A,40B,84C 'without':36B 'woocommerc':9A,19B,34B,81C 'wordpress':3A,20B,24B,64C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Synchrony Financing WordPress plugin earlier than 1.1.2 with WooCommerce are exposed, because the flawed route acts on live order records. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-100145","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-100145","severity":null,"published_at":"2026-10-21T06:16:44+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-100145","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-100145","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}