Live › vulnerability › CVE-2026-94272
Go to dashboardThe Snap Finance WordPress plugin before 3.12.0 does not check that a request to change a WooCommerce order's status is authorised. An unauthenticated attacker can mark any order as paid or force it to fail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Snap Finance WordPress plugin below alongside WooCommerce are exposed, because the order-status endpoint accepts requests without verifying the caller. Sites without this plugin, or already on or later, are not affected. The sources do not say which exact endpoint or setting is involved.
3.12.03.12.0No product ranges from the sources yet.
3.12.0 are affected.3.12.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
This page as .md · .json · in your agent: get_signal("CVE-2026-94272")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.