CVE-2026-100145: Synchrony Financing 1.0.5 to before 1.1.2

Affected technology

Synchrony Financing · 1.0.5 to before 1.1.2
Vendor not specified by the source

Description’s affected range: before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders

Component: Not specified by the source

What an attacker can do

Unauthenticated attackers can reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.

Published 21-Oct-2026 07:00 UTC

KEV: no

Provenance

GitHub Advisory Database · Source record · observed 2026-10-21 07:07:14.882325+00:00 UTC
NVD CVE API 2.0 · Source record · observed 2026-10-21 07:00:36.165049+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-100145.html