CVE-2026-94261: Unknown Sifalo Pay

Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days.

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.

Affected products

• Unknown Sifalo Pay: from 2.0, before 2.5.3 (fixed in 2.5.3)

Published 2026-10-14. Last modified 2026-10-14.