CVE-2026-94260: Sifalo Pay 2.0 to before 2.5.3

Affected technology

Sifalo Pay · 2.0 to before 2.5.3
Vendor not specified by the source

Description’s affected range: before 2.5.3 does not verify ownership of

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

The source says the Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state. Source advisory’s CVSS 3.1 assessment (base score 5.3/10) rates confidentiality and integrity impact as none; availability impact as low.