CVE-2026-1722mediumCWE-862

CVE-2026-1722: fallo de gravedad media en wclovers WCFM Marketplace – Multivendor…

WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear WCFM Marketplace – Multivendor Marketplace for WooCommerce

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.3%
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce
CVEs relacionadas — wclovers WCFM Marketplace – Multivendor…

En el mismo producto, de las más peligrosas a las menos.

CVE-2022-4935HIGHWCFM Marketplace <= 3.4.11 - Missing AuthorizationEPSS 0.7%CVE-2026-18442HIGHWCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' ParameterEPSS 0.7%CVE-2023-4960MEDIUMWCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-12126MEDIUMWCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'EPSS 0.4%CVE-2022-4936MEDIUMWCFM Marketplace <= 3.4.12 - Cross-Site Request ForgeryEPSS 0.2%