Eupago Gateway for WooCommerce EUVD-2026-32727

The vulnerable site must have the Eupago Gateway for WooCommerce WordPress plugin installed and active at a version below 4.7.2 with at least one WooCommerce order processed via Eupago that can be referenced by the attacker (order IDs are typically sequential integers and easily enumerated). No authentication, user interaction, or special configuration toggles are required - the refund request handler is reachable by unauthenticated network callers in the default deployment per the description. The full attacker-controlled-bank-account outcome is limited to 'applicable payment methods' supported by Eupago that allow specifying a refund destination at refund time; for other Eupago methods the attack still causes unauthorized refunds (financial loss and operational disruption to the merchant) but funds return to the original payer rather than the attacker.

Real-world risk is elevated. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N is fully aligned with the description - remote, unauthenticated, no user interaction, low complexity - and the I:H rating correctly captures financial integrity loss (refunds issued and funds redirected). The Scope:U and only L/L for confidentiality/availability are consistent with the impact being limited to order/payment data within the merchant's WooCommerce instance rather than full site takeover. Publicly available exploit code from WPScan materially raises near-term exploitation likelihood for any internet-exposed shop running the vulnerable plugin, especially given WooCommerce shops are easily fingerprinted. EPSS score is not provided in the input, so quantitative exploitation probability cannot be cited; KEV listing is not present, so this is not yet confirmed actively exploited. Given direct monetary impact and a public PoC, this should be treated as a high-priority patch for any WooCommerce store running Eupago, even absent KEV confirmation.

An attacker enumerates a WooCommerce store running the vulnerable Eupago plugin, iterates known or guessed order IDs, and sends crafted unauthenticated requests to the plugin's refund handler that cause the merchant's Eupago credentials to issue refunds; for payment methods where the refund destination is attacker-controllable, the funds land in the attacker's bank account, monetizing the bug directly. Because public exploit code is available via WPScan and the attack requires no privileges or user interaction, scripted abuse against many small merchants is realistic.