EUVD-2026-51699
GHSA-63p2-7wgc-gxrq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-accessible AJAX endpoint; PR:L required as any authenticated WordPress session suffices; Integrity High for unauthorized financial refunds; no confidentiality or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.
AnalysisAI
Missing authorization controls in the Buckaroo WooCommerce Payments Plugin before 4.9.0 allow any authenticated WordPress user - including low-privilege Subscribers - to trigger payment capture refunds against any captured order via an unprotected AJAX endpoint. The flaw causes direct financial integrity loss for merchants, as unauthorized refund processing reverses captured payments without any approval workflow. A publicly available exploit exists per WPScan, though EPSS remains very low at 0.13% (3rd percentile), indicating exploitation has not become widespread despite the accessible attack surface.
Technical ContextAI
The vulnerability is rooted in CWE-284 (Improper Access Control). WordPress plugin AJAX actions registered without a call to current_user_can() and without nonce verification can be invoked by any authenticated session, regardless of intended privilege scope. The affected plugin integrates the Buckaroo payment gateway with WooCommerce and exposes an AJAX handler for triggering refunds on captured orders - a financial operation that should require at minimum shop manager or administrator capabilities. The absence of both a capability check and nonce validation means any authenticated WordPress session can invoke this action directly via a POST request to wp-admin/admin-ajax.php. The affected CPE is cpe:2.3:a:unknown:buckaroo_woocommerce_payments_plugin:*:*:*:*:*:wordpress:*:* across all versions prior to 4.9.0.
RemediationAI
The primary fix is to upgrade the Buckaroo WooCommerce Payments Plugin to version 4.9.0 or later, which introduces proper capability checks and nonce validation on the affected AJAX refund action. Update via the WordPress admin dashboard under Plugins > Installed Plugins, or through WP-CLI with 'wp plugin update'. Full advisory details are at https://wpscan.com/vulnerability/6e60d271-574d-4259-ab51-32a014e480d4/. As a compensating control while patching, administrators should disable open user registration (Settings > General > uncheck 'Anyone can register') to prevent unknown parties from obtaining the authenticated session required for exploitation - note this blocks legitimate new user registration as a side effect. Additionally, reviewing existing Subscriber-level accounts and removing unnecessary ones reduces the pre-existing attack surface.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today