medium5.3
CVE-2026-94273
The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction befor…
Impact
The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.
Affected products
| Product | Affected versions |
|---|---|
| Snap Finance WordPress Plugin | through 3.11.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.