CVE-2026-100145
Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommerce orders, allowing unauthenticated attackers to reassign any order to an account they control, tamper with its details, and read the associated customer's personal data.
| Vendor | unknown |
| Product | synchrony financing |
| Published | Oct 21, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown synchrony financing
Be the first to know when new unknown vulnerabilities affecting unknown synchrony financing are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Synchrony Financing
1.0.5 < 1.1.2
References
Credits
Naoki Kawahigashi WPScan