CVE-2026-7862
Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation
- State
- Published
- Severity
- 8.6 High
- Published
- May 28, 2026
- Updated
- May 28, 2026
- Reserved
- May 5, 2026
Description
The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated attackers to initiate refunds against any WooCommerce order using the merchant's payment gateway credentials, and for applicable payment methods, to redirect refunded funds to an attacker-controlled bank account.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.6 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L | CISA-ADP |
Weaknesses
- CWE-284 Improper Access Control
Affected Products
| Product | Versions |
|---|---|
Eupago Gateway For WoocommerceUnknown |
|
References
- https://wpscan.com/vulnerability/b4ce2a06-b435-4b77-851f-4406f2a91ca6/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.