CVE-2026-94272 — Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

CVE-2026-94272

Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions PUBLISHED

Description (CNA)

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.

Affected (CNA)

Vendor / product	Versions
Unknown / Snap Finance	affected 1.0.8 before 3.12.0

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/e3a4931a-3678-46ac-9ad0-3cc6a1ed5d90/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.