PT-2026-117239

CVE-2026-94273

Published

2026-10-16

Updated

2026-10-29

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Snap Finance WordPress plugin versions prior to 3.11.1

Description The plugin fails to verify if the payment provider response confirms a completed and approved transaction before updating a WooCommerce order status to paid. This allows unauthenticated attackers to mark arbitrary orders as paid without actually completing the payment process.

Recommendations Update the Snap Finance WordPress plugin to version 3.11.1 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Ryan Fabella

Vendors

Affected products

Weakness enumeration

CWE-862: Missing Authorization

Related identifiers