CVE-2026-100145: Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route

Q: Which installations are affected?

Synchrony Financing versions 1.0.5 through 1.1.1 are affected. The issue is fixed in version 1.1.2.

Q: Does exploitation require an authenticated WordPress or WooCommerce account?

No. The vulnerable REST route can be abused by unauthenticated attackers.

Q: What can an attacker do through the vulnerable route?

An attacker can reassign any WooCommerce order to an account they control, alter order details, and access the associated customer's personal data.

Published Oct 21, 2026

Updated

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.

Affected Software

1 affected component

Synchrony Synchrony Financing<1.1.2

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which installations are affected?

Synchrony Financing versions 1.0.5 through 1.1.1 are affected. The issue is fixed in version 1.1.2.

Does exploitation require an authenticated WordPress or WooCommerce account?

No. The vulnerable REST route can be abused by unauthenticated attackers.

What can an attacker do through the vulnerable route?

An attacker can reassign any WooCommerce order to an account they control, alter order details, and access the associated customer's personal data.

CVE-2026-100145: Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress or WooCommerce account?

What can an attacker do through the vulnerable route?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress or WooCommerce account?

What can an attacker do through the vulnerable route?