CVE-2026-94272
Received Received - Intake

Unauthenticated Order Status Change in Snap Finance WordPress Plugin

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WPScan

Description
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-94272
EUVD
EUVD-2026-104106

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Snap Finance 1.0.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects the Snap Finance WordPress plugin versions 1.0.8 to 3.11.0. It allows unauthenticated attackers to change the status of WooCommerce orders via AJAX actions without proper authorization. Attackers can mark orders as paid or failed without needing to authenticate, exploiting missing access control checks.

Detection Guidance

To detect this vulnerability, check if your WordPress site uses the Snap Finance plugin versions 1.0.8 to 3.11.0. Inspect the plugin version in the WordPress admin panel under Plugins. If the version is within this range, the site is vulnerable. Additionally, monitor WooCommerce order status changes for unauthorized modifications.

Impact Analysis

This vulnerability could allow attackers to manipulate order statuses in your WooCommerce store. They could mark unpaid orders as paid, leading to financial losses, or force orders to fail, disrupting legitimate transactions. It may also affect customer trust and business operations.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized changes to order statuses, which may lead to improper financial processing or data integrity issues. Unauthorized modifications could result in incorrect financial records or mishandling of personal data, violating principles of data protection and financial accountability.

Mitigation Strategies

Immediately update the Snap Finance plugin to version 3.12.0 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Ensure all WordPress and WooCommerce installations are updated to the latest versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94272. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart