Snap Finance
Monthly
Unauthenticated WooCommerce order-status manipulation in the Snap Finance WordPress plugin before 3.12.0 allows remote attackers to mark arbitrary orders as paid or failed because the status-change handler does not verify that the request comes from an authorised source. The flaw has a CVSS 3.1 base score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to order-state integrity and no confidentiality or availability impact. Publicly available exploit code exists, but no CISA KEV entry was provided indicating confirmed active exploitation.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on WordPress sites running the Snap Finance plugin through version 3.11.0, because the plugin's payment-return handling never verifies that the provider actually approved a completed transaction. Publicly available exploit code exists and the flaw needs no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 5.3 medium), but exploitation is limited to sites where the plugin is active and Snap Finance is enabled as a checkout payment method. Impact is confined to integrity of order/payment status - fraudulent marking of orders as paid - with no data disclosure, site compromise, or availability loss.
Unauthenticated WooCommerce order-status manipulation in the Snap Finance WordPress plugin before 3.12.0 allows remote attackers to mark arbitrary orders as paid or failed because the status-change handler does not verify that the request comes from an authorised source. The flaw has a CVSS 3.1 base score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), with impact limited to order-state integrity and no confidentiality or availability impact. Publicly available exploit code exists, but no CISA KEV entry was provided indicating confirmed active exploitation.
Unauthenticated attackers can mark arbitrary WooCommerce orders as paid on WordPress sites running the Snap Finance plugin through version 3.11.0, because the plugin's payment-return handling never verifies that the provider actually approved a completed transaction. Publicly available exploit code exists and the flaw needs no credentials or user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N, 5.3 medium), but exploitation is limited to sites where the plugin is active and Snap Finance is enabled as a checkout payment method. Impact is confined to integrity of order/payment status - fraudulent marking of orders as paid - with no data disclosure, site compromise, or availability loss.