WCFM Marketplace <= 3.8.3 - Authenticated (Store Vendor+) Missing Authorization to Refund Request Approval and Rejection
- ID
- WPSEC-2026-2371
- Plugin
- WCFM Marketplace – Multivendor Marketplace for WooCommerce (wc-multivendor-marketplace)
- Affected
- all versions before 3.8.4
- Remediation
- Update to 3.8.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-03
- Attack surface
- WCFM Marketplace on WPSec AttackSurface
- Fix released
- Published
Description
The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 3.8.3 due to an insufficient capability check on the 'wcfm-refund-requests-approve' and 'wcfm-refund-requests-cancel' AJAX actions, which allowed any vendor or vendor staff member, and did not prevent already completed requests from being approved again. This makes it possible for authenticated attackers with vendor-level access to approve or reject other vendors' refund requests, creating real refunds on other stores' orders, altering their commissions, and repeatedly refunding the same order.
References
- https://wpsec.com/vuln/WPSEC-2026-2371/
- https://plugins.svn.wordpress.org/wc-multivendor-marketplace/tags/3.8.4/
- https://wordpress.org/plugins/wc-multivendor-marketplace/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS