CVE-2026-94272
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Oct 19, 2026
Vendor
unknown
Description
The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail.