Snap Finance WordPress plugin up to version 3.11.0 lacks verification that a payment provider’s response confirms a completed, approved transaction before marking a WooCommerce order as paid. This flaw means an attacker can exploit the snap_finance_complete_payment endpoint to create a forged payment record. Based on the description, it is inferred that an unauthenticated request can cause any order to be recorded as paid without real payment, undermining financial integrity and potentially leading to revenue loss and unintended order fulfillment.

WordPress installations running the Snap Finance plugin version 3.11.0 or earlier are affected. These setups integrate WooCommerce for order management and process payments through Snap Finance. No other vendors or specific product versions are listed beyond the Snap Finance plugin for WordPress.

Based on the description, the likely attack vector is an unauthenticated HTTP request to the publicly accessible snap_finance_complete_payment endpoint. The CVSS score of 5.3 indicates medium severity. The EPSS score is not available and the issue is not in the CISA KEV catalog, but the lack of verification presents a high business impact. Although no high exploitability is confirmed, the potential revenue loss and unintended order fulfilment suggest a moderate to high risk if the flaw remains unaddressed.