Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Sifalo Pay 2.5.3 Clear all filters
TI-2026-73785 CVE-2026-94261 · GHSA-crq3-gj9c-hjq2

Unbound transaction ID lets attackers mark orders as paid in Sifalo Pay

Priority LOW 30

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00239 Published 2026-10-14 Fixed in 2.5.3 CWE-639
TI-2026-73784 CVE-2026-94260 · GHSA-c2m5-wfwq-jh99

Sifalo Pay Missing Authorization Enables Unauthenticated Order Tampering

Priority LOW 30

The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment ses…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00306 Published 2026-10-14 Fixed in 2.5.3 CWE-862