GCVE - cpe:2.3:a:unknown:sifalo

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:sifalo_pay:*:*:*:*:*:*:*:*

part: a version: * update: *

Notes

Imported from gcve-enriched-dumps CVE data

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-94260`	vulnerable	2026-11-03 10:15:43.824354	Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto any order in the store and to force any order awaiting payment into a failed state. Published: 2026-10-14T06:00:15.757Z Updated: 2026-10-14T13:42:20.700Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/cbb9ff30-9145-43a8-ab8a-157a5a0ef9dd/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-94261`	vulnerable	2026-11-03 10:15:43.794223	Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid. Published: 2026-10-14T06:00:15.930Z Updated: 2026-10-14T13:42:20.558Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/3a9d4c71-6cbd-44ff-a6d8-802107491212/	Imported from gcve-enriched-dumps CVE data

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.