CVE-2026-94260: CWE-862 Missing Authorization in Sifalo Pay
Description
CVE-2026-94260 is a missing authorization vulnerability in the Sifalo Pay WordPress plugin versions 2.0 up to but not including 2.5.3. The plugin does not verify ownership or authorization when updating orders during payment return handling. This flaw allows unauthenticated attackers to write arbitrary payment session metadata to any order and force orders awaiting payment into a failed state.
Affected software
Sifalo Pay
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Sifalo Pay WordPress plugin before version 2.5.3 fails to verify whether the user updating an order during payment return is authorized or owns the order. This missing authorization (CWE-862) enables unauthenticated attackers to manipulate payment session metadata on any order in the store and to change the status of orders awaiting payment to failed.
Potential Impact
An attacker without authentication can modify payment session data for any order and force orders awaiting payment into a failed state. This could disrupt order processing and potentially cause denial of service or confusion in order management. There is no indication of direct financial theft or privilege escalation beyond order manipulation.
Mitigation Recommendations
Upgrade the Sifalo Pay plugin to version 2.5.3 or later, where this authorization issue is fixed. No other mitigation is indicated. Patch status is confirmed by the version range affected and the fixed version 2.5.3.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-21T09:02:56.713Z
- State
- PUBLISHED
Threat ID: 6acf225a2cdf04f656513bb6
Added to database: 10/14/2026, 06:34:02 UTC
Last enriched: 10/14/2026, 06:49:12 UTC
Last updated: 10/14/2026, 06:49:12 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.