WordPress Plugin Vulnerabilities

Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id

Description

The plugin does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.

Proof of Concept

Affects Plugins

Plugin icon
sifalo-pay
Fixed in 2.5.3

References

CVE
CVE-2026-94261

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ryan Fabella
Submitter
Ryan Fabella
Verified
Yes
WPVDB ID
3a9d4c71-6cbd-44ff-a6d8-802107491212

Timeline

Publicly Published
2026-10-12 (about 2 days ago)
Added
2026-10-12 (about 1 day ago)
Last Updated
2026-10-12 (about 1 day ago)

Other

Published
Title
Published
2026-08-24
Title
Royal Elementor Addons < 1.7.1066 - Unauthenticated Like Count and IP Meta Modification via wpr_likes_init
Published
2024-02-05
Title
CP Polls < 1.0.72 - Unauthenticated Poll Limit Bypass
Published
2026-02-10
Title
Videospirecore Theme Plugin <= 1.0.6 - Authenticated (Subscriber+) Privilege Escalation via User Email Change/Account Takeover
Published
2025-03-19
Title
NP Quote Request for WooCommerce < 1.9.180 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure
Published
2026-04-07
Title
Masteriyo LMS < 2.1.8 - Unauthenticated Authorization Bypass to Arbitrary Order Completion via Stripe Webhook Endpoint