The Sifalo Pay WordPress plugin version 2.0 through 2.5.2 allows an unauthenticated attacker to modify payment session metadata for any order. The plugin fails to verify that the requester owns or is authorized to update the order when processing a payment return. As a result, an attacker can change arbitrary order details and force an order awaiting payment into a failed state. This type of exploitation is a classic permission‑check bypass identified as CWE-862.

Affected products are the Sifalo Pay WordPress plugin for any WordPress site, specifically versions 2.0.0 to 2.5.2 inclusive. Any installation of the plugin that has not been upgraded to the patched 2.5.3 release remains vulnerable. The plugin is used by e‑commerce sites to handle payment processing and order updates.

The vulnerability has a CVSS score of 5.3, indicating moderate risk, with an EPSS score of less than 1% pointing to a very low likelihood of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is external: an unauthenticated HTTP request to the payment return endpoint can trigger the flaw. An attacker needs to know or guess a valid order ID to achieve an impact; no special privileges or credentials are required.