CVE-2026-94273
Received Received - Intake

Unauthenticated Payment Completion in Snap Finance WordPress Plugin

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: WPScan

Description
The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-94273
EUVD
EUVD-2026-104088

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Snap Finance 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Snap Finance WordPress plugin before version 3.12.0 fails to verify if a payment provider's response confirms a completed transaction before marking a WooCommerce order as paid. This allows unauthenticated attackers to forge payment confirmations and mark orders as paid without actual payment completion.

Detection Guidance

Check if your WordPress site uses the Snap Finance plugin version 3.11.0 or earlier. Inspect WooCommerce order logs for suspicious transactions marked as paid without valid payment confirmations. Review server access logs for unauthenticated POST requests to payment confirmation endpoints.

Impact Analysis

This vulnerability allows attackers to trick the system into believing they paid for orders without actually completing transactions. This could lead to financial losses for merchants, unauthorized access to paid services, or fraudulent transactions being processed.

Compliance Impact

This vulnerability could lead to unauthorized transactions being marked as paid, potentially violating financial record-keeping requirements under GDPR and HIPAA. It may result in improper handling of payment data, affecting compliance with data integrity and security controls.

Mitigation Strategies

Update the Snap Finance plugin to version 3.12.0 or later immediately. Disable the plugin temporarily if an update is not available. Monitor WooCommerce orders for unauthorized status changes to paid.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94273. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart