CVE-2026-94261

Deferred Deferred - Pending Action

Unauthenticated Order Manipulation in Sifalo Pay WordPress Plugin

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: WPScan

Description

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-94261

EUVD

EUVD-2026-100867

Affected Vendors & Products

Vendor	Product	Version / Range
Unknown	Sifalo	Pay 2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

The Sifalo Pay WordPress plugin before version 2.5.3 has a flaw where it does not properly verify if a payment transaction identifier belongs to the specific order being confirmed or if the requester owns that order. This allows unauthenticated attackers with a valid transaction ID from their own payment to mark any pending order as paid without authorization.

Detection Guidance

Check if the Sifalo Pay WordPress plugin version is between 2.0 and 2.5.2. Inspect server logs for unauthorized payment confirmations or orders marked as paid without valid transactions. Look for requests to the plugin's payment confirmation endpoint with mismatched transaction IDs.

Impact Analysis

This vulnerability could allow attackers to manipulate order statuses without paying, leading to financial losses or unauthorized access to paid services. It may also disrupt legitimate transactions and cause confusion in order management.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized modifications to transaction records. Unauthenticated attackers could mark orders as paid without proper authorization, which may lead to incorrect financial data integrity. This could result in non-compliance with data accuracy requirements under GDPR Article 5 and HIPAA's integrity principles.

Mitigation Strategies

Update the Sifalo Pay plugin to version 2.5.3 or later immediately. Disable the plugin temporarily if an update is not immediately available. Review all pending orders for unauthorized changes and verify payment transactions manually.

Hi! I’m here to help you understand CVE-2026-94261. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70