Eupago Gateway For Woocommerce
Monthly
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers trigger refunds on arbitrary WooCommerce orders using the merchant's own payment gateway credentials, and for certain payment methods divert the refunded funds to an attacker-controlled bank account. The CVSS 8.6 score reflects the network-reachable, no-auth, no-interaction attack path against a financial workflow; publicly available exploit code exists per WPScan, though there is no public exploit identified at time of analysis confirming active exploitation in CISA KEV.
Unauthenticated attackers can forge payment-confirmation webhook requests to the Eupago Gateway For WooCommerce WordPress plugin (versions 4.5.0 through 4.7.5) when the store runs a configuration in which the plugin fails to verify webhook authenticity, letting them mark a pending order as paid without actually paying. Impact is integrity-only (no data exposure or availability loss) at CVSS 5.3, and the flaw is scoped to 'some configurations,' so properly validated deployments are not affected. A public PoC reference exists via the WPScan advisory, but it is not verified as working exploit code; there is no KEV listing and exploitation has not been confirmed in the wild.
Unauthenticated refund abuse in the Eupago Gateway for WooCommerce WordPress plugin before 4.7.2 lets remote attackers trigger refunds on arbitrary WooCommerce orders using the merchant's own payment gateway credentials, and for certain payment methods divert the refunded funds to an attacker-controlled bank account. The CVSS 8.6 score reflects the network-reachable, no-auth, no-interaction attack path against a financial workflow; publicly available exploit code exists per WPScan, though there is no public exploit identified at time of analysis confirming active exploitation in CISA KEV.
Unauthenticated attackers can forge payment-confirmation webhook requests to the Eupago Gateway For WooCommerce WordPress plugin (versions 4.5.0 through 4.7.5) when the store runs a configuration in which the plugin fails to verify webhook authenticity, letting them mark a pending order as paid without actually paying. Impact is integrity-only (no data exposure or availability loss) at CVSS 5.3, and the flaw is scoped to 'some configurations,' so properly validated deployments are not affected. A public PoC reference exists via the WPScan advisory, but it is not verified as working exploit code; there is no KEV listing and exploitation has not been confirmed in the wild.