The Synchrony Financing WordPress plugin, versions prior to 1.1.2, fails to properly authorise requests to the admin_order_callback REST route. This oversight lets attackers create or modify WooCommerce orders without authentication, reassigning orders to accounts they control, altering order details, and accessing personal customer data. The resulting breach jeopardises both the integrity of transactional records and the confidentiality of sensitive shopper information.

The vulnerability affects installations of the Synchrony Financing plugin on WordPress sites, specifically any versions earlier than 1.1.2. Users running those versions should verify their plugin version and plan an update.

The CVSS score is 6.5, and the EPSS score is < 1%. The issue is not listed in the CISA KEV catalog. The likely attack vector is the publicly accessible admin_order_callback REST route, which, due to missing authorization checks, can be exploited by unauthenticated users. An attacker can launch the exploit from any network location with HTTP access to the site, making the vulnerability broadly exploitable when the plugin is present and not patched.