GCVE - cpe:2.3:a:unknown:snap_finance:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:snap_finance:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Snap Finance (`f5e6e60d-bf97-5c8e-8404-6eeab62a638c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-94273`	vulnerable	2026-11-03 10:15:43.637353	Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment. Published: 2026-10-19T06:00:13.365Z Updated: 2026-10-19T09:31:19.231Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/62c8b34a-44f3-4739-9ca6-fce0f2a5ffaf/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-94272`	vulnerable	2026-11-03 10:15:43.601873	Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions MEDIUM (5.3) The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail. Published: 2026-10-19T06:46:20.466Z Updated: 2026-10-19T09:31:20.467Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/e3a4931a-3678-46ac-9ad0-3cc6a1ed5d90/	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.