Unknown Sifalo Pay vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Sifalo Pay, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2026-94261unknownsifalo pay
EPSS score
0.24%
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.5.3CVE-2026-94260unknownsifalo pay
EPSS score
0.31%
The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state.