Snap Finance EUVD-2026-104106

Requires only that the Snap Finance WordPress plugin before version 3.12.0 be installed and active on a WooCommerce store; the vulnerable order-status-change request handler performs no verification that the request comes from an authorised source, so no authentication, no user interaction, and no non-default configuration are needed (AV:N/AC:L/PR:N/UI:N). The practical limiting factors are narrow: the site must run this specific plugin and WooCommerce, and impact is bounded to altering order status (e.g., forcing 'paid' or 'failed') - there is no data read or site takeover, so realistic harm is payment/fulfilment fraud and transaction disruption rather than full compromise.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 Medium) describes a cleanly remote, unauthenticated, low-complexity broken-access-control flaw with no user interaction, but limited to a low integrity impact and zero confidentiality or availability impact - consistent with the description, which permits manipulating WooCommerce order state (paid/failed) rather than reading data or taking over the site. Publicly available exploit code (reported by WPScan) raises practical risk, but there is no CISA KEV listing and no EPSS score was provided, so there is no evidence of active exploitation - this is best treated as POC-available, not in-the-wild. The signals are internally consistent (unauthenticated network vector matches the 'authorised source not verified' description); the main caveat is that CVSS caps this at Medium because only order status integrity is affected, yet the real-world business impact (fraudulently forcing orders into a 'paid' state to obtain goods without payment) may exceed what a 5.3 implies for a merchant. Net: a genuine, easily-exploitable access-control bug worth prompt patching for affected stores, but lower blast radius than a code-execution or data-exposure flaw and not a mass-exploitation emergency.

An attacker sends a crafted, unauthenticated HTTP request to the vulnerable Snap Finance plugin endpoint that changes a WooCommerce order's status, without any valid authorisation token. Because the plugin does not verify the request source, the attacker forces a target order into a 'paid' state (potentially triggering fulfilment of goods without real payment) or into a 'failed' state to disrupt legitimate transactions. Public exploit code exists (WPScan), lowering the skill required to reproduce the attack.