CVE-2026-94272: Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Snap Finance WordPress plugin versions 1.0.8 through 3.11.0 are affected. Version 3.12.0 and later are not identified as affected by the provided information.
What does an attacker need to exploit this issue?
An attacker can exploit the issue remotely without authentication or user interaction. The vulnerable AJAX actions allow changing the status of any WooCommerce order.
What is the practical impact of exploitation?
An attacker can move an order into a paid state or force an order to fail. The reported impact is integrity-only; no confidentiality or availability impact is specified.
What should teams do if they cannot patch immediately?
The provided information does not identify a workaround or mitigation other than updating to version 3.12.0 or later.