EUVD-2026-67571
GHSA-m58g-jhp8-rgr8
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable endpoint requires no auth or interaction; impact is limited integrity (fraudulent refund creation) with no confidentiality or availability consequence.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.
AnalysisAI
Missing authorization in WCFM Marketplace WordPress plugin before 3.8.2 allows unauthenticated users to submit refund requests against any guest checkout order without verifying order ownership. The flaw (CWE-862) targets the refund request endpoint, which performs no ownership check for guest orders, enabling arbitrary financial disruption to marketplace vendors. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) WCFM Marketplace plugin installed and active on a WordPress/WooCommerce site running a version before 3.8.2; (2) Guest checkout enabled on the WooCommerce store - the vulnerability is explicitly scoped to guest checkout orders, meaning registered-user orders are not affected; (3) Knowledge of a valid guest order ID, which can often be inferred from sequential WooCommerce order numbering or exposed in order confirmation emails shared by users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N reflects network-reachable, low-complexity, unauthenticated exploitation - a straightforward attack profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade WCFM Marketplace to version 3.8.2 or later, which introduces the ownership verification check for refund requests on guest orders. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Wcfm Marketplace
View allThe WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up t
SQL injection in the WCFM Marketplace plugin for WordPress allows authenticated high-privilege users (e.g., administrato
The WCFM Marketplace plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including,
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today