CVE-2026-94260

Deferred Deferred - Pending Action

Unauthenticated Order State Manipulation in Sifalo Pay WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94260

EUVD

EUVD-2026-100866

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Sifalo	Pay 2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

The Sifalo Pay WordPress plugin before version 2.5.3 has a vulnerability where it does not check if a user is authorized to update an order when processing a payment return. This allows unauthenticated attackers to modify payment session data on any order and force orders waiting for payment into a failed state.

Detection Guidance

Check if the Sifalo Pay WordPress plugin version is between 2.0 and 2.5.2. Look for unauthorized modifications to order payment metadata or forced order failures in transaction logs.

Impact Analysis

Unauthenticated attackers could manipulate order statuses, causing legitimate transactions to fail. This may lead to financial losses, disrupted services, or reputational damage for businesses using the plugin.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized modifications to payment metadata and order states. Unauthenticated attackers could alter payment session data, which may lead to improper handling of financial transactions and sensitive customer information. This could violate data integrity and access control requirements under these regulations.

Mitigation Strategies

Update the Sifalo Pay plugin to version 2.5.3 or later immediately to patch the vulnerability. Remove or disable the plugin if updating is not possible.

Hi! I’m here to help you understand CVE-2026-94260. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70