WordPress Plugin Vulnerabilities

Snap Finance < 3.12.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment

Description

The plugin does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.

Proof of Concept

Affects Plugins

Plugin icon
snap-finance-checkout
Fixed in 3.12.0

References

CVE
CVE-2026-94273

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Ryan Fabella
Submitter
Ryan Fabella
Verified
Yes
WPVDB ID
62c8b34a-44f3-4739-9ca6-fce0f2a5ffaf

Timeline

Publicly Published
2026-10-16 (about 2 days ago)
Added
2026-10-09 (about 9 days ago)
Last Updated
2026-10-15 (about 3 days ago)

Other

Published
Title
Published
2024-07-18
Title
YITH Essential Kit for WooCommerce #1 < 2.35.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation
Published
2025-03-13
Title
Zegen - Church WordPress Theme <= 1.1.9 - Missing Authorization to Authenticated (Subscriber+) Theme Options Updates
Published
2026-01-27
Title
Rupantorpay <= 2.0.0 - Missing Authorization to Unauthenticated Order Status Modification
Published
2025-11-28
Title
Virtuaria PagBank / PagSeguro para Woocommerce < 3.6.4 - Missing Authorization
Published
2026-01-16
Title
RepairBuddy < 4.1121 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders