CVE-2026-94260: Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure
The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Sifalo Payto a version that resolves this vulnerability.Fixed in 2.5.3
Event History
Frequently Asked Questions
Which stores are exposed?
Stores using the Sifalo Pay WordPress plugin before version 2.5.3 are affected. Orders that are awaiting payment can be forced into a failed state.
What does an attacker need to exploit this issue?
No authentication is required. The vulnerable payment-return handling does not verify ownership of or authorization for the order being updated.
What can an attacker change?
An attacker can write arbitrary payment session metadata to any order in the store. They can also force an order awaiting payment to fail.
What should be prioritized for remediation?
Update the Sifalo Pay WordPress plugin to version 2.5.3 or later. The issue affects versions before 2.5.3.