Live › vulnerability › CVE-2026-94273
Go to dashboardThe Snap Finance WordPress plugin through 3.11.0 does not check that the payment provider's response confirms an approved transaction before it marks a WooCommerce order as paid. An unauthenticated attacker can therefore mark arbitrary orders as paid without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores running the Snap Finance WordPress plugin version 3.11.0 or earlier with WooCommerce, where orders can be paid through Snap Finance. Sites that do not use this plugin or its payment gateway are not affected.
No product ranges from the sources yet.
3.11.0 or earlier (WordPress admin under Plugins, or wp plugin get <slug> --field=version)3.11.0 once a fixed release is published; the sources do not name one, so check the plugin's page on WordPress.orgEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-94273")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.