Sifalo Pay EUVD-2026-100866

No authentication, no user interaction, and no special privileges are required (AV:N/AC:L/PR:N/UI:N): the payment-return endpoint of Sifalo Pay before 2.5.3 fails to verify order ownership or authorization, so any remote party can target orders by ID. The practical prerequisite is simply that the store runs the vulnerable plugin and has orders in an 'awaiting payment' state for the force-to-failed action to take effect. Limiting factors: impact is confined to tampering with order/payment-session records and disrupting pending orders - there is no code execution, no confidentiality disclosure, and no site-level authentication bypass - and the deployment footprint of this niche plugin is small.

This is a genuine but limited-impact issue - a solid 'medium' rather than a top priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms remote, unauthenticated, low-complexity exploitation with no user interaction, which is consistent with the description of an unauthenticated missing-authorization (CWE-862) flaw reachable through the payment-return handler. However, every impact-weighting signal points to low real-world severity: CVSS scores it only 5.3 (C:N/I:N/A:L), EPSS is just 0.17% (5th percentile), it is NOT on CISA KEV, and SSVC rates Exploitation as 'none' (no observed active exploitation) with Technical Impact 'partial'. The one aggravating signal is SSVC Automatable:yes combined with publicly available exploit code (WPScan), meaning the flaw could be scripted against many stores - but the actual damage is confined to tampering with order records (writing payment-session metadata, forcing awaiting-payment orders into a failed state), not RCE, data theft, or auth bypass into the site. Note a discrepancy worth verifying: the official vector records C:N/I:N/A:L, yet the description explicitly says an attacker can 'write arbitrary payment session metadata onto any order,' which is an integrity impact the official vector does not credit (see assessed vector below). Net: patch promptly for e-commerce/order-integrity reasons, but this is not an emergency and shows no sign of widespread or targeted exploitation.

An unauthenticated attacker sends crafted payment-return requests to a store running a vulnerable Sifalo Pay plugin, referencing order IDs they do not own. Because the handler never verifies order ownership or authorization, the attacker writes arbitrary payment-session metadata onto those orders and flips any order awaiting payment into a failed state, disrupting checkout and corrupting order records. Public exploit code exists (WPScan), and the flaw is machine-automatable, so enumeration across many orders is feasible.