---
id: "CVE-2026-100145"
kind: "vulnerability"
aliases: ["CVE-2026-100145"]
title: "Synchrony Financing WordPress plugin: unauthenticated REST route alters WooCommerce orders"
severity: "medium"
cvss: 6.5
epss: 0.00209
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-1.1.2-or-later", "plugin-not-installed"]
published_at: "2026-10-21T06:16:44+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:49:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100145", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-100145", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Synchrony Financing WordPress plugin: unauthenticated REST route alters WooCommerce orders

The Synchrony Financing WordPress plugin before 1.1.2 has a REST route that modifies WooCommerce orders without checking authorisation. An unauthenticated attacker can reassign any order to an account they control, change its details, and read the customer's personal data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Synchrony Financing plugin in the WordPress admin plugins list, or run `wp plugin get synchrony-financing --field=version` (plugin slug unknown from sources; confirm it).
- Look for the plugin's REST routes with `wp eval 'print_r(array_keys(rest_get_server()->get_routes()));'` and check for a route that updates WooCommerce orders.

## Fix

- Update the Synchrony Financing WordPress plugin to `1.1.2` or later.
- If you cannot update yet, deactivate the plugin until the update is applied.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-100145
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-100145

## From the sources

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_