CVE-2026-94272: CWE-862 Missing Authorization in Snap Finance

The Snap Finance WordPress plugin versions from 1.0.8 up to but not including 3.12.0 contain a missing authorization vulnerability (CWE-862). Specifically, the plugin does not verify that requests to change WooCommerce order statuses originate from authorized sources. As a result, unauthenticated attackers can manipulate order statuses, such as moving orders into a paid state or forcing them to fail, without proper permissions. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the network attack vector, low complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but integrity impact is low.

An attacker can alter the status of WooCommerce orders managed by the Snap Finance plugin without authentication. This can lead to unauthorized financial state changes, such as marking unpaid orders as paid or causing orders to fail. While this does not affect confidentiality or availability, it impacts the integrity of order data, potentially causing business process disruptions or financial inconsistencies.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to order status change endpoints and monitor for suspicious activity related to order status changes.