EUVD-2026-107048
GHSA-mr5q-g9rw-x79g
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Synchrony Financing plugin
-
ExploitSend unauthenticated request to vulnerable REST route
-
ExecutionBypass order authorization check
-
ImpactReassign order and read customer PII
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization logic validation
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the Synchrony Financing WordPress plugin (version 1.0.5 up to but not including 1.1.2) is installed and active on a WooCommerce store, and that existing orders are present to target. The vulnerable path is the plugin's own REST route that modifies WooCommerce orders, which fails to properly authorize the request - so no valid account, credentials, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). The primary limiting factor is deployment scope: only sites running this specific plugin version alongside WooCommerce are affected, and impact is confined to order data and the associated customer's personal data rather than full site compromise. Updating to 1.1.2 removes the condition. |
| Impact | This is a moderate-severity broken-authorization flaw (CWE-863, CVSS 6.5) in the Synchrony Financing WordPress plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which raises real-world concern because the barrier to abuse is minimal and a public exploit exists (WPScan). However, impact is bounded: the vector rates confidentiality and integrity as Low (C:L/I:L) and availability as None (A:N), and the scope is unchanged (S:U) - an attacker can reassign/tamper with WooCommerce orders and read the associated customer's PII, but cannot take over the site or escalate to RCE. The vulnerability is NOT in CISA KEV (no confirmed active exploitation), and no EPSS score was provided in the input, so widespread automated exploitation cannot be asserted from the data. Signals are consistent rather than conflicting: unauthenticated + public POC + available patch means this should be prioritized for any site running the affected plugin, but the capped L/L/N impact keeps it below critical. Net: a genuine, promptly-patchable priority for affected WooCommerce stores (data-exposure and order-fraud risk), not a site-takeover emergency. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted request to the plugin's improperly-authorized REST route targeting an existing WooCommerce order. They reassign the order to an account they control, alter its details, and read the legitimate customer's personal data (name, address, contact info). A public exploit referenced by WPScan lowers the skill required to carry this out at scale against vulnerable stores. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 21, 2026
Broken authorization on a plugin REST route lets unauthenticated attackers take over existing WooCommerce orders on stores running the Synchrony Financing WordPress plugin (affected range 1.0.5 up to, but not including, 1.1.2) - reassigning an order to an account they control, altering its contents, and reading the associated customer's personal data. Rated CVSS 6.5 (CWE-863) with a network-reachable, no-prerequisite attack path (AV:N/AC:L/PR:N/UI:N), the flaw is narrow in deployment scope but exposes customer PII wherever it is present, and publicly available exploit code exists. No confirmed active exploitation (CISA KEV) was observed at time of analysis, and a vendor-released patch (1.1.2) is available.
RemediationAI
Upgrade the Synchrony Financing plugin to version 1.1.2 or later, which removes the unauthorized REST path; the vendor-released patch is confirmed available, and WPScan's entry (https://wpscan.com/vulnerability/87d37c99-1229-4747-b562-5151aa9e92f2/) documents the fixed build. Where upgrading cannot be done immediately, deactivate the plugin if its financing features are not in active use - this eliminates exposure entirely at the cost of losing Synchrony checkout functionality - or block anonymous access to the plugin's REST namespace at the WAF/reverse-proxy layer (deny unauthenticated requests under /wp-json/ matching the plugin's route prefix) while allowing logged-in store administrators through; note that over-broad rules blocking all of /wp-json/ will break the WordPress block editor and WooCommerce Store API. Because affected sites may already have been targeted, review WooCommerce order records for unexplained customer-ID reassignment, changed billing/shipping fields, or unusual REST access logs, and treat any exposed customer personal data as potentially disclosed for breach-notification assessment.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin registers a custom WordPress REST API endpoint (via register_rest_route) that performs write operations against WooCommerce order objects, but fails to enforce an adequate permission check on that route - the classic CWE-863 'Incorrect Authorization' pattern in WordPress plugins, where a route's permission_callback either is absent, returns true unconditionally, or validates the wrong capability/nonce. Because WordPress dispatches REST requests before any capability gate the plugin would otherwise rely on, an anonymous HTTP request to the plugin's route namespace reaches order-mutation logic directly: order ownership/customer assignment can be changed (order hijack), order fields can be modified, and order metadata containing the customer's personal data can be read back. The attack surface is the WordPress REST API (/wp-json/) on WooCommerce sites, and no authentication or user interaction is required per the CVSS vector (PR:N/UI:N). The supplied CPE (cpe:2.3:a:unknown:synchrony_financing) leaves the vendor namespace unenumerated, so version-based detection should key on the plugin slug and the EUVD-confirmed range 1.0.5 < 1.1.2.
Know when Synchrony Financing gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Unauthenticated network REST route with no authorization check gives AV:N/AC:L/PR:N/UI:N; order tampering and per-customer PII read yield I:L/C:L with no availability impact and unchanged scope.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB