CVE-2026-94261: Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using the Sifalo Pay WordPress plugin in versions before 2.5.3 are affected. Orders that are pending payment are the target because they can be marked as paid.
What does an attacker need to exploit it?
An attacker does not need to authenticate to the affected site. They need one valid payment transaction identifier from a payment they made themselves, which can then be used to confirm arbitrary pending orders.
Is the transaction identifier required to belong to the order being confirmed?
No. Affected versions do not verify that the supplied transaction identifier belongs to the order being confirmed, and they do not verify that the requester owns that order.
How can I determine whether my site is affected?
Check the installed Sifalo Pay plugin version. Versions before 2.5.3 are affected; version 2.5.3 or later is not identified as affected by the provided information.