Sifalo Pay – Mobile Money & Card Payments for WooCommerce
Sifalo Pay – Mobile Money & Card Payments for WooCommerce has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of October 2026. Their average CVSS score is 5.3, and the most serious one scores 5.3 out of 10. 2026 was the busiest year with 2 disclosures.
The most common weakness is Missing Authorization, behind 2 of the records (100%).
Every one of the 2 issues recorded for Sifalo Pay – Mobile Money & Card Payments for WooCommerce has a vendor fix available, so running the current release closes all known holes.
2 independent researchers contributed these findings, one record each. Sifalo Pay – Mobile Money & Card Payments for WooCommerce is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-94261Sifalo Pay – Mobile Money & Card Payments for WooCommerce 2.0 - 2.5.2 - Missing Authorization
Read the full analysisVulnerability Records
Sifalo Pay – Mobile Money & Card Payments for WooCommerce
Author
Sifalo
woocommerceSifalo Pay for WooCommerce is a payment gateway that lets customers in Somalia, Somaliland and Djibouti pay with the mobile money wallet or card they already use, while you get paid through your Sifalo Pay account. Enter your API credentials once and every supported payment method appears at checkout automatically. Supported payment methods Mobile money: EVC Plus, ZAAD, eDahab, Sahal, Premier Wallet Cards: Mastercard and Visa New methods added to Sifalo Pay become available without reinstalling the plugin. Features One-step setup. Enter your API User and API Key once. No per-method configuration. Live and Staging modes. Test the full payment flow before accepting real payments. Automatic order verification. Pending orders are re-checked in the background, so successful payments are not missed. Pending-aware wallet payments. Mobile wallet payments awaiting customer approval stay pending instead of failing checkout. Refunds from WooCommerce. Issue refunds through the Sifalo Pay API (full refunds for ZAAD). Clear checkout experience. Mobile-friendly payment fields, a processing overlay, and plain-language error messages. Order notes for debugging. Failed payments are logged to the order notes. HPOS and PHP 8.3 compatible. Works with WooCommerce High-Performance Order Storage. Requirements WordPress 5.4+ and PHP 7.4+ WooCommerce with the classic (shortcode) checkout. The Cart and Checkout blocks are not supported yet. A free Sifalo Pay account: https://sifalopay.com Third-party service This plugin sends order and payment details (order ID, amount, currency, and customer billing details) to the Sifalo Pay API to process payments and verify their status. A Sifalo Pay account is required. Service: Sifalo Pay, operated by Sifalo Technologies Caching and Performance Payment API calls and order updates run on the server and are not affected by page caching. Problems only appear when checkout HTML, checkout fragments, or JS/CSS are cached or combined incorrectly. No Sifalo-specific rules are needed beyond standard WooCommerce caching practice. Recommended setup Enable WooCommerce mode in your caching plugin if it has one (WP Rocket, LiteSpeed Cache, WP-Optimize and similar). Never cache these URLs (adjust for your permalinks, e.g. /en/checkout/): /cart/ /checkout/ /my-account/ order-received (thank-you) pages any URL containing ?add-to-cart= any URL containing ?sid= (card payment return from Sifalo) any URL containing ?key= (WooCommerce order key) Exclude WooCommerce cookies from caching: woocommerce_items_in_cart, woocommerce_cart_hash, wp_woocommerce_session_*. Also enable “Do not cache for logged-in users”. Exclude from JS/CSS minify, combine and defer: sifalo-pay-public.js, sifalo-pay-public.css, and jquery if checkout breaks after enabling defer. Purge everything (page, object, opcode and CDN caches) and retest in a private window. Do not full-page cache checkout for performance. Use object caching or a CDN for static assets only.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C