CVE-2026-94261 Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id
Unauthenticated attackers can forge payment confirmations for arbitrary orders by reusing valid transaction IDs, bypassing payment verification logic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94261?
CVE-2026-94261 is a medium-severity vulnerability in Unknown Sifalo Pay, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order, allowing unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid.
Weakness: CWE-639
Which versions are affected by CVE-2026-94261?
How do I fix CVE-2026-94261?
No fix has been published for CVE-2026-94261 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-94261 being exploited?
There is no known exploitation of CVE-2026-94261 in the wild and no public exploit code.
Sources
Also known as GHSA-crq3-gj9c-hjq2.