CVE-2026-1722mediumCWE-862

CVE-2026-1722: medium-severity vulnerability in wclovers WCFM Marketplace – Multivendor…

WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation

Published · Updated

Follow this CVE+ Monitor WCFM Marketplace – Multivendor Marketplace for WooCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.3%
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce
Related CVEs — wclovers WCFM Marketplace – Multivendor…

In the same product, most dangerous first.

CVE-2022-4935HIGHWCFM Marketplace <= 3.4.11 - Missing AuthorizationEPSS 0.7%CVE-2026-18442HIGHWCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' ParameterEPSS 0.7%CVE-2023-4960MEDIUMWCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-12126MEDIUMWCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'EPSS 0.4%CVE-2022-4936MEDIUMWCFM Marketplace <= 3.4.12 - Cross-Site Request ForgeryEPSS 0.2%