What is the CVSS score of CVE-2026-7862?

CVE-2026-7862 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.0%.

Which versions of Eupago Gateway for WooCommerce are affected by CVE-2026-7862?

The Eupago Gateway for WooCommerce plugin (versions before 4.7.2) contains an unauthenticated vulnerability allowing remote attackers to trigger arbitrary refunds and divert funds to…. A patch is available.

Is there a public PoC exploit available for CVE-2026-7862?

Yes, a public proof-of-concept exploit is available for CVE-2026-7862. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-7862?

Within 24 hours: Immediately update Eupago Gateway for WooCommerce to version 4.7.2 or later; if immediate patching is not possible, disable the plugin and switch to an alternative payment processor. Within 7 days: Verify all instances of the plugin across the organization are patched, audit refund transaction logs from the vulnerability discovery date backward for suspicious or unauthorized refunds, and cross-check refund destinations against approved merchant accounts. Within 30 days: Conduct comprehensive financial reconciliation of all refunds processed during the vulnerable period, implement real-time monitoring for refund transactions exceeding policy thresholds, and establish a monthly plugin update verification process to prevent similar gaps.

Eupago Gateway for WooCommerce CVE-2026-7862

EUVD-2026-32727 HIGH

Improper Access Control (CWE-284)

2026-05-28 WPScan

GHSA-fppg-vjhw-hp4m

WordPress Authentication Bypass

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 12:22 vuln.today

CVSS changed

May 28, 2026 - 12:22 NVD

8.6 (HIGH)

Patch available

May 28, 2026 - 09:01 EUVD

CVE Published

May 28, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

CVE Published

May 28, 2026 - 06:00 nvd

HIGH 8.6

DescriptionCVE.org

The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated attackers to initiate refunds against any WooCommerce order using the merchant's payment gateway credentials, and for applicable payment methods, to redirect refunded funds to an attacker-controlled bank account.

AnalysisAI

Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers trigger refunds on arbitrary WooCommerce orders using the merchant's own payment gateway credentials, and for certain payment methods divert the refunded funds to an attacker-controlled bank account. The CVSS 8.6 score reflects the network-reachable, no-auth, no-interaction attack path against a financial workflow; publicly available exploit code exists per WPScan, though there is no public exploit identified at time of analysis confirming active exploitation in CISA KEV.

Technical ContextAI

The affected component is a WordPress plugin (CPE cpe:2.3:a:unknown:eupago_gateway_for_woocommerce) that integrates the Portuguese Eupago payment service provider with WooCommerce, handling order payments and refund workflows. The root cause is CWE-284 (Improper Access Control): the refund request handler endpoint, presumably an AJAX or REST callback intended for authenticated merchant/admin use, does not enforce capability checks (e.g., manage_woocommerce) or nonce validation before invoking the gateway's refund API. Because WordPress plugins commonly expose admin-ajax.php actions to both authenticated and unauthenticated callers depending on the hook prefix (wp_ajax_nopriv_*), missing authorization on a sensitive financial handler turns a privileged operation into one any visitor can invoke against any order ID.

RemediationAI

Upgrade the Eupago Gateway for WooCommerce plugin to version 4.7.2 or later, which is the vendor-released patch addressing the missing access control on the refund handler; this is the only complete fix and should be applied immediately given the public PoC. Until the update can be deployed, deactivate the Eupago Gateway for WooCommerce plugin (trade-off: Eupago payment methods will be unavailable to customers, breaking checkout for those options) or block the specific plugin AJAX/REST refund endpoint at a WAF or reverse proxy by URL pattern (trade-off: legitimate merchant-initiated refunds via that endpoint will also fail and must be issued through an alternate workflow). Restricting WordPress admin-ajax.php and wp-json paths to authenticated sessions via IP allowlisting in front of the site can also reduce exposure but may break other unauthenticated plugin features. After patching, audit recent WooCommerce refund records and Eupago merchant transaction logs for anomalous refunds and review payout destination changes; advisory references: https://wpscan.com/vulnerability/b4ce2a06-b435-4b77-851f-4406f2a91ca6/ and https://nvd.nist.gov/vuln/detail/CVE-2026-7862.