CVE-2026-1722mediumCWE-862

CVE-2026-1722: falha de média gravidade em wclovers WCFM Marketplace – Multivendor…

WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar WCFM Marketplace – Multivendor Marketplace for WooCommerce

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.3%
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
wclovers · WCFM Marketplace – Multivendor Marketplace for WooCommerce
CVEs relacionadas — wclovers WCFM Marketplace – Multivendor…

No mesmo produto, das mais perigosas para as menos.

CVE-2022-4935HIGHWCFM Marketplace <= 3.4.11 - Missing AuthorizationEPSS 0.7%CVE-2026-18442HIGHWCFM Marketplace <= 3.8.2 - Unauthenticated SQL Injection via 'wcfmmp_user_location_lat' / 'wcfmmp_user_location_lng' ParameterEPSS 0.7%CVE-2023-4960MEDIUMWCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2026-12126MEDIUMWCFM Marketplace <= 3.7.3 - Authenticated (Vendor+) Stored Cross-Site Scripting via Attachment 'post_title'EPSS 0.4%CVE-2022-4936MEDIUMWCFM Marketplace <= 3.4.12 - Cross-Site Request ForgeryEPSS 0.2%