CVE-2026-94260

The Sifalo Pay WordPress plugin (versions 2.0 - 2.5.2 ) contains a vulnerability where it fails to verify ownership or authorization when handling a payment return . This flaw allows unauthenticated attackers to write arbitrary payment session metadata onto any store order and force orders awaiti...

CVE-2026-94261

The Sifalo Pay WordPress plugin (versions 2.0 through 2.5.2) contains a vulnerability where it fails to verify if a payment transaction identifier belongs to the specific order being confirmed or if the requester owns that order. This allows an unauthenticated attacker to use a valid transaction ...

EUVD-2026-100867

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitra...

EUVD-2026-100866

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...