Snap Finance CVE-2026-94273

Requires that the target WordPress site has the Snap Finance plugin (version ≤3.11.0) installed and active with Snap Finance enabled as a WooCommerce payment method, and that the plugin's payment-return/callback endpoint is reachable over the network. No authentication, credentials, or user interaction are needed (PR:N/UI:N), and default configurations are vulnerable because the plugin unconditionally trusts the payment provider's response instead of verifying an approved transaction. The main limiting factors are therefore deployment-based rather than technical: the specific plugin must be installed and offering Snap Finance at checkout, and an order must exist (which an attacker can create themselves) to be marked paid; impact is confined to fraudulent order status and does not yield data disclosure or site compromise.

This is a CVSS 5.3 (medium) flaw, and the signals are internally consistent rather than conflicting. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N makes it trivially reachable: remote, unauthenticated, low-complexity, no user interaction - any attacker who can reach the payment callback endpoint can attempt it. The impact is deliberately scoped to integrity only (C:N/I:L/A:N): no data is stolen and nothing is taken offline; instead orders are fraudulently marked paid, which is a direct financial-loss / fraud risk to the merchant rather than a system-compromise risk. Publicly available exploit code exists (reported by WPScan), which raises practical exploitability above the raw score. However, this is NOT in CISA KEV, and no EPSS score was provided in the input, so exploitation-probability cannot be quantified - treat widespread active exploitation as unconfirmed. No SSVC decision data was supplied either. Net assessment: a genuine, easy-to-exploit fraud vector for any store running this plugin, but the modest CVSS reflects the integrity-only impact and the comparatively narrow deployment footprint of a single-vendor payment plugin - prioritize patching for affected merchants, but it is not a mass-compromise crisis on the level of a critical RCE.

A store running the Snap Finance plugin offers it as a WooCommerce checkout option. An unauthenticated attacker creates an order, then sends a forged payment-provider callback (or replays/crafts the return response) that the plugin accepts without verifying the transaction was actually approved, so the order flips to 'paid' and the attacker receives goods or services for free. A public proof-of-concept exists via WPScan, lowering the bar to reproduce this.