Vulnerability · Published Oct 21, 2026 · Assigned by WPScan
CVE-2026-100145Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route
Medium 6.5
In plain English
A medium-severity incorrect authorization in Synchrony Financing from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 81.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Synchrony Financing | 1.0.5 – before 1.1.2 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/87d37c99-1229-4747-b562-5151aa9e92f2/ exploit, vdb-entry, technical-description