Synchrony Financing CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review Synchrony Financing CVE published 2026-10-21

CVE-2026-100145

The Synchrony Financing WordPress plugin before 1.1.2 has an unauthenticated order takeover vulnerability via the admin_order_callback REST route. This allows attackers to reassign orders, modify details, and access customer personal data. The vulnerability impacts WordPress installations using versions 1.0.5 to 1.1.1 of the plugin. Defenders should verify exposure and apply necessary mitigations to restr [truncated]