CVE-2026-94260
Medium
Description
The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state.
SeverityMedium
CVSS5.3
Exploit probability23. percentile0.3%
ProductSifalo Pay
PublishedOct 14, 2026
First seenOct 14, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- Sifalo Pay2.5.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Sifalo Pay | 2.0 ≤ v < 2.5.3 | 2.5.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.