Vulnerability · Published Oct 14, 2026 · Assigned by WPScan
CVE-2026-94260Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure
Medium 5.3
In plain English
A medium-severity missing authorization in Sifalo Pay from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.3%top 76.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Sifalo Pay | 2.0 – before 2.5.3 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://wpscan.com/vulnerability/cbb9ff30-9145-43a8-ab8a-157a5a0ef9dd/ exploit, vdb-entry, technical-description