WordPress Synchrony Financing plugin 1.0.5-1.1.1 - Unauthenticated Order Takeover vulnerability

Unauthenticated Order Takeover vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Synchrony Financing versions 1.0.5-1.1.1...

CVE-2026-100145

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's...

CVE-2026-100145 Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's...

EUVD-2026-107048

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's...

CVE-2026-100145

The Synchrony Financing WordPress plugin, in versions prior to 1.1.2 , contains an incorrect authorization vulnerability (CWE-863) within the admin_order_callback REST route. This flaw allows unauthenticated attackers to modify WooCommerce orders , enabling them to reassign any order to a control...

CVE-2026-100145 Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's...

PT-2026-120443

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's...

CVE-2026-23348

In the Linux kernel, the following vulnerability has been resolved: cxl: Fix race of nvdimmbus object when creating nvdimm objects Found issue during running of cxl-translate.sh unit test. Adding a 3s sleep right before the test seems to make the issue reproduce fairly consistently. The...

DEBIAN-CVE-2025-39966

In the Linux kernel, the following vulnerability has been resolved: iommufd: Fix race during abort for file descriptors fput doesn't actually call fileoperations release synchronously, it puts the file on a work queue and it will be released eventually. This is normally fine, except for iommufd t...

EUVD-2023-2761

Malicious code in bioql PyPI...

Five Minutes of DDoS Brings Down Tor: DDoS Attacks on the Tor Directory Protocol and Mitigations

The Tor network offers network anonymity to its users by routing their traffic through a sequence of relays. A group of nine directory authorities maintains information about all available relay nodes using a distributed directory protocol. We observe that the current protocol makes a steep...

Merge Conflicts PRs in Confluence-Distribution

Merge conflicts PRs in Confluence-Distribution after synchrony update PRs...

GHSA-JG82-XH3W-RHXX Synchrony deobfuscator prototype pollution vulnerability leading to arbitrary code execution

Impact A proto pollution vulnerability exists in synchrony versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. Summary A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify properties in the Object prototype. When...

CVE-2023-45811

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A proto pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify...

Code injection

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A proto pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify...

CVE-2023-45811 Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A proto pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify...

CVE-2023-45811 Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A proto pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify...

CVE-2023-45811 Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A proto pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A proto pollution vulnerability exists in the LiteralMap transformer allowing crafted input to modify...

CVE-2023-45811

Synchrony deobfuscator (JavaScript cleaner/deobfuscator) contains a prototype pollution vulnerability in the LiteralMap transformer that allows crafted input to modify Object.prototype. This affects versions before 2.4.4 and could lead to arbitrary code execution. A fix is available in deobfuscat...

CVE-2023-45811

Synchrony deobfuscator is a javascript cleaner & deobfuscator. A "proto" pollution vulnerability exists in versions before v2.4.4. Successful exploitation could lead to arbitrary code execution. A "proto" pollution vulnerability exists in the "LiteralMap" transformer allowing crafted input to...