Sifalo Pay
Monthly
Unauthenticated attackers can mark arbitrary pending orders as paid in the Sifalo Pay WordPress plugin before version 2.5.3 by reusing a single valid payment transaction identifier harvested from a legitimate purchase of their own, because the plugin does not bind that identifier to the order being confirmed and does not check that the requester owns the order. The result is a moderate-severity integrity flaw (CVSS 5.3, CWE-639, PR:N/UI:N, no confidentiality or availability impact); publicly available exploit code exists, but there is no confirmed active exploitation, EPSS is low at 0.17 percent (5th percentile), and CISA SSVC records exploitation as none while noting the issue is automatable. Reaching the flaw still requires a site running a vulnerable plugin version with pending orders in its flow plus at least one real transaction the attacker can complete to obtain a usable identifier.
Unauthenticated attackers can write arbitrary payment session metadata onto any order and force any awaiting-payment order into a failed state in Sifalo Pay WordPress plugin versions before 2.5.3, because the payment-return handler does not verify order ownership or authorization. Publicly available exploit code exists, though EPSS is 0.17% (5th percentile) and no active exploitation is confirmed. The independent assessment rates this as a genuine but limited-impact medium issue: no code execution, no confidentiality loss, and only low integrity and availability impact.
Unauthenticated attackers can mark arbitrary pending orders as paid in the Sifalo Pay WordPress plugin before version 2.5.3 by reusing a single valid payment transaction identifier harvested from a legitimate purchase of their own, because the plugin does not bind that identifier to the order being confirmed and does not check that the requester owns the order. The result is a moderate-severity integrity flaw (CVSS 5.3, CWE-639, PR:N/UI:N, no confidentiality or availability impact); publicly available exploit code exists, but there is no confirmed active exploitation, EPSS is low at 0.17 percent (5th percentile), and CISA SSVC records exploitation as none while noting the issue is automatable. Reaching the flaw still requires a site running a vulnerable plugin version with pending orders in its flow plus at least one real transaction the attacker can complete to obtain a usable identifier.
Unauthenticated attackers can write arbitrary payment session metadata onto any order and force any awaiting-payment order into a failed state in Sifalo Pay WordPress plugin versions before 2.5.3, because the payment-return handler does not verify order ownership or authorization. Publicly available exploit code exists, though EPSS is 0.17% (5th percentile) and no active exploitation is confirmed. The independent assessment rates this as a genuine but limited-impact medium issue: no code execution, no confidentiality loss, and only low integrity and availability impact.