{"id":"CVE-2026-94273","kind":"vulnerability","aliases":["CVE-2026-94273"],"related":[],"title":"Snap Finance WordPress plugin: unpaid WooCommerce orders can be marked as paid","description":"The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.","summary":"The Snap Finance WordPress plugin through 3.11.0 does not check that the payment provider's response confirms an approved transaction before it marks a WooCommerce order as paid. An unauthenticated attacker can therefore mark arbitrary orders as paid without paying.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","package","snap-finance","woocommerce","wordpress"],"not_affected_if":["gateway-disabled","plugin-not-installed"],"how_to_check":"- Check whether the Snap Finance plugin is installed and its version is `3.11.0` or earlier (WordPress admin under Plugins, or `wp plugin get <slug> --field=version`)\n- Confirm the plugin's payment gateway is enabled in WooCommerce settings","fix":"- Update the Snap Finance WordPress plugin to a version later than `3.11.0` once a fixed release is published; the sources do not name one, so check the plugin's page on WordPress.org\n- Until a fix is available, disable the Snap Finance payment gateway in WooCommerce","status":"open","published_at":"2026-10-19T06:17:25+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:26:36+00:00","updated_at":"2026-10-25T04:26:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:26:36Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Snap Finance WordPress plugin to a version later than `3.11.0` once a fixed release is published; the sources do not name one, so check the plugin's page on WordPress.org\n- Until a fix is available, disable the Snap Finance payment gateway in WooCommerce","reach":"internet","title":"Snap Finance WordPress plugin: unpaid WooCommerce orders can be marked as paid","impact":"medium","summary":"The Snap Finance WordPress plugin through 3.11.0 does not check that the payment provider's response confirms an approved transaction before it marks a WooCommerce order as paid. An unauthenticated attacker can therefore mark arbitrary orders as paid without paying.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce","snap-finance"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker marks arbitrary store orders paid without paying","analyst_note":"Confirm the fixed plugin version and whether the gateway must be enabled for exposure, via the NVD entry and the WordPress.org plugin page.","how_to_check":"- Check whether the Snap Finance plugin is installed and its version is `3.11.0` or earlier (WordPress admin under Plugins, or `wp plugin get <slug> --field=version`)\n- Confirm the plugin's payment gateway is enabled in WooCommerce settings","needs_analyst":true,"not_affected_if":["plugin-not-installed","gateway-disabled"],"who_is_affected":"Stores running the Snap Finance WordPress plugin version 3.11.0 or earlier with WooCommerce, where orders can be paid through Snap Finance. Sites that do not use this plugin or its payment gateway are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000656,"input_tokens":3311,"output_tokens":650,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-94273':15A,18A '3.11.0':32B,72C 'actual':82C 'allow':95C 'approv':44B,86C 'arbitrari':60B,100C 'attack':56B,97C 'check':35B 'complet':85C,105C 'confirm':42B,83C 'cve':13A,16A 'ecommerc':19B 'financ':2A,23B,28B,68C 'mark':10A,48B,59B,89C,99C 'order':7A,51B,61B,92C,101C 'packag':20B 'paid':12A,53B,63B,94C,103C 'pay':65B 'payment':38B,78C,106C 'plugin':4A,30B,70C 'provid':39B,79C 'respons':41B,81C 'snap':1A,22B,27B,67C 'snap-fin':21B 'therefor':58B 'transact':45B,87C 'unauthent':55B,96C 'unpaid':5A 'verifi':75C 'without':64B,104C 'woocommerc':6A,24B,50B,91C 'wordpress':3A,25B,29B,69C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Snap Finance WordPress plugin version 3.11.0 or earlier with WooCommerce, where orders can be paid through Snap Finance. Sites that do not use this plugin or its payment gateway are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T06:17:25+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-94273","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94273","severity":null,"published_at":"2026-10-19T06:17:25+00:00","modified_at":"2026-10-19T21:02:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}