The Snap Finance WordPress plugin contains a flaw that allows a threat actor to send requests that change the status of any WooCommerce order, including setting it to paid or failing, without authentication. The vulnerability stems from a failure to validate the source of the request that triggers the status change, enabling attackers to manipulate order states and potentially affect revenue and order fulfillment. The weakness is an example of improper authorization controls over order state transitions.

Snap Finance WordPress plugin versions 1.0.8 through 3.11.0, running on any WordPress installation that uses WooCommerce. The issue requires only a public or unauthenticated web request to an AJAX endpoint exposed by the plugin.

The CVSS score of 5.3 categorises the flaw as moderately severe. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed public exploitation yet. The most likely attack vector occurs through unauthenticated AJAX calls that the plugin exposes to front‑end users; because the plugin does not enforce any authorization checks on these calls, any attacker who can reach the site can trigger order state changes. If exploited, the attacker could manually mark orders as paid, altering billing records, or force orders to fail, disrupting order processing.