What is GHSA-mr5q-g9rw-x79g?

GHSA-mr5q-g9rw-x79g is a security advisory published by GitHub Security Advisories with Medium severity. The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one...

Which CVE IDs does GHSA-mr5q-g9rw-x79g cover?

GHSA-mr5q-g9rw-x79g covers the following CVE IDs: CVE-2026-100145. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-mr5q-g9rw-x79g?

GHSA-mr5q-g9rw-x79g has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-mr5q-g9rw-x79gMediumCVSS 6.5

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one...

Vendor

GitHub Security Advisories

Published

October 21, 2026

Last Modified

October 21, 2026

🔗 CVE IDs covered (1)

CVE-2026-100145 →

📋 Description

The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-100145
https://wpscan.com/vulnerability/87d37c99-1229-4747-b562-5151aa9e92f2
https://github.com/advisories/GHSA-mr5q-g9rw-x79g