WCFM Marketplace CVE-2026-77701

Exploitation requires: (1) WCFM Marketplace plugin installed and active on a WordPress/WooCommerce site running a version before 3.8.2; (2) Guest checkout enabled on the WooCommerce store - the vulnerability is explicitly scoped to guest checkout orders, meaning registered-user orders are not affected; (3) Knowledge of a valid guest order ID, which can often be inferred from sequential WooCommerce order numbering or exposed in order confirmation emails shared by users. No authentication is required (PR:N confirmed by CVSS). Exploitation is limited to guest checkout orders only - any order tied to a registered user account falls outside the vulnerable code path, substantially reducing the attack surface on stores with low guest checkout usage.

The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N reflects network-reachable, low-complexity, unauthenticated exploitation - a straightforward attack profile. SSVC signals reinforce this: Automatable:yes confirms the attack can be scripted at scale, while Technical Impact:partial and Exploitation:none indicate no active campaigns and bounded damage. The publicly available POC (via WPScan) meaningfully raises practical risk above what SSVC exploitation:none might suggest, since script-kiddie actors can trivially leverage it. The 'Information Disclosure' tag in the source data conflicts with the CVSS C:N rating - the actual impact appears to be unauthorized integrity modification (fraudulent refund creation), not data exfiltration; this tagging discrepancy should be noted but does not change the overall assessment. Real-world financial impact depends heavily on whether vendors auto-approve refunds or require manual review: in automated pipelines, this vulnerability could result in direct revenue loss for marketplace sellers.

An unauthenticated attacker enumerates or guesses sequential WooCommerce guest order IDs (a common pattern in stores without order ID obfuscation), then submits crafted refund requests against valid guest orders via the WCFM Marketplace refund endpoint. A publicly available POC from WPScan enables automated bulk submission across all discoverable guest orders, potentially triggering refund workflows for many vendors simultaneously without any account or session credential.