The Sifalo Pay WordPress plugin before version 2.5.3 lacks an ownership or authorization check during the payment return process, allowing an unauthenticated attacker to modify the payment session metadata of any order. This flaw permits the attacker to alter arbitrary fields associated with the payment session and to force an order that is awaiting payment into a failed state. The impacted data integrity and order state may be compromised. The vulnerability is classified as a permission‑check bypass (CWE‑862).

Affected systems are WordPress installations that use the Sifalo Pay plugin in any version prior to 2.5.3, specifically from 2.0.0 through 2.5.2 inclusive. Sites that have not upgraded the plugin are vulnerable. The plugin handles payment processing and order updates for e‑commerce sites.

The flaw carries a CVSS score of 5.3, indicating moderate risk, and an EPSS score of less than 1%, suggesting a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is external: an unauthenticated HTTP request to the payment return endpoint can trigger the vulnerability. An attacker must know or guess a valid order identifier to achieve an impact, but no privileged credentials are required.