Description

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-28T08:16:41.587Z",
  "pubdate": "2026-08-28T08:16:41.587Z",
  "executiveSummary": "The WCFM Marketplace WordPress plugin, in versions prior to 3.8.2, contains a critical Broken Access Control vulnerability that permits unauthorized refund requests.\nThe vulnerability is classified as an Improper Authorization flaw, allowing unauthenticated attackers to interact with the refund submission mechanism.\nBy failing to validate the ownership of an order during the refund request process, the plugin exposes guest checkout transactions to manipulation.\nAn attacker can leverage this flaw to initiate fraudulent refund requests against any valid guest order processed through the marketplace platform.\nThe security implications include potential financial loss, disruption of marketplace operations, and the exploitation of legitimate guest transaction data.\nSuccessful exploitation does not require prior authentication or elevated privileges, making the attack vector highly accessible from any remote network location.\nThis vulnerability poses a significant risk to store integrity and payment processing workflows, necessitating immediate updates to remediate the authorization logic failure.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient server-side validation of user identity within the WCFM Marketplace refund request handler. Specifically, the component responsible for processing refund initiation fails to implement an ownership check to verify that the session or request parameters correspond to the entity that actually purchased the order.\nIn the context of the WordPress lifecycle, the plugin does not enforce a secure association between the current user's session identifier or verified guest credentials and the target order ID provided in the refund request payload. Because the input validation logic neglects to compare the request's origin against the stored order metadata, the system assumes the validity of any request targeting a guest-originated transaction.\nThe exploitation flow is relatively straightforward: an attacker identifies a valid order ID, likely via brute force or by leveraging publicly exposed checkout information or information disclosure leaks. Once a target ID is acquired, the attacker submits a crafted HTTP request to the vulnerable refund-handling endpoint. The backend application, processing this request, performs the necessary database operations to flag the target order for a refund or triggers the notification flow to the vendor, bypassing all access control layer checks.\nBecause the function fails to check the cryptographic signature of the request or verify the guest's session tokens, the application interprets the request as legitimate. Consequently, the attacker can force the system to process refund requests for orders they do not own, which could lead to unauthorized inventory release, financial reconciliation issues, or further exploitation if the refund flow triggers administrative or vendor-side actions.\nThis vulnerability is present in all versions of the WCFM Marketplace plugin prior to 3.8.2. It is considered a remote, unauthenticated vulnerability. The impact is significant as it directly affects the integrity of the e-commerce transaction lifecycle, allowing malicious actors to abuse the refund feature without possessing valid customer credentials or authorization tokens associated with the original purchase. Post-exploitation, an attacker may continue to target additional orders, potentially causing widespread administrative burden and financial inconsistencies across the marketplace ecosystem."
}