What is GHSA-qrcf-6rx9-2mwc?

GHSA-qrcf-6rx9-2mwc is a security advisory published by GitHub Security Advisories with Medium severity. The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's...

Which CVE IDs does GHSA-qrcf-6rx9-2mwc cover?

GHSA-qrcf-6rx9-2mwc covers the following CVE IDs: CVE-2026-94273. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qrcf-6rx9-2mwc?

GHSA-qrcf-6rx9-2mwc has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-qrcf-6rx9-2mwcMediumCVSS 5.3

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's...

Vendor

GitHub Security Advisories

Published

October 19, 2026

Last Modified

October 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-94273 →

📋 Description

The Snap Finance WordPress plugin through 3.11.0 does not verify that the payment provider's response actually confirms a completed, approved transaction before marking a WooCommerce order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid without completing payment.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-94273
https://wpscan.com/vulnerability/62c8b34a-44f3-4739-9ca6-fce0f2a5ffaf
https://github.com/advisories/GHSA-qrcf-6rx9-2mwc