The Sifalo Pay WordPress plugin prior to version 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming or that the requester owns that order. This allows an attacker who has collected a single valid transaction identifier from their own payment to mark any pending order as paid. The resulting unauthorized confirmation can lead to financial losses, incorrect invoicing, and fraudulent order fulfillment.

WordPress sites utilizing the Sifalo Pay plugin in the 2.0 through 2.5.2 release range are affected. Version 2.5.3 and later contain the fix that verifies transaction ownership and requester authorization.

With a CVSS score of 5.3 the vulnerability is considered medium severity. The EPSS score of less than 1% indicates a low probability of exploitation in general, and the flaw is not listed in the CISA KEV catalog. Attackers require possession of a valid transaction identifier, which can be obtained by making an initial payment with their own account. Once acquired, the attacker can send unauthenticated requests to the payment confirmation endpoint, potentially causing arbitrary orders to be marked as paid and triggering downstream processing. The exploit does not require code injection or privilege escalation; it simply abuses inadequate authorization checks.