Sifalo CVE debriefs

CVE-2026-94261

The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns that order. This allows unauthenticated attackers holding one valid transaction identifier from a payment of their own to mark arbitrary pending orders as paid. The vulnerability could lead to financial losses if exploited. Defenders should a [truncated]