CVE-2026-94272 — Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated a…
Published: 2026-10-19 · CVSS: 5.3 · CVSS 3.1
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7