CVE-2026-94260

The Sifalo Pay WordPress plugin (versions 2.0 - 2.5.2 ) contains a vulnerability where it fails to verify ownership or authorization when handling a payment return . This flaw allows unauthenticated attackers to write arbitrary payment session metadata onto any store order and force orders awaiti...

WordPress Sifalo Pay plugin 2.0-2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability

Unauthenticated Order Payment Metadata Modification and Forced Order Failure vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Sifalo Pay versions 2.0-2.5.2...

CVE-2026-94260 Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting...