Description
The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Snap Finance | ≤ 3.11.0 | — |
References
- https://wpscan.com/vulnerability/62c8b34a-44f3-4739-9ca6-fce0f2a5ffaf/ exploit vdb-entry technical-description