# WCFM Marketplace <= 3.8.3 - Authenticated (Store Vendor+) Missing Authorization to Refund Request Approval and Rejection

- **ID:** WPSEC-2026-2371
- **Plugin:** WCFM Marketplace – Multivendor Marketplace for WooCommerce (`wc-multivendor-marketplace`), https://wordpress.org/plugins/wc-multivendor-marketplace/
- **Affected versions:** all versions before 3.8.4
- **Fixed in:** 3.8.4 (Update to 3.8.4 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wc-multivendor-marketplace
- **Fix released:** 2026-11-02
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2371/

## Description

The WCFM Marketplace plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 3.8.3 due to an insufficient capability check on the 'wcfm-refund-requests-approve' and 'wcfm-refund-requests-cancel' AJAX actions, which allowed any vendor or vendor staff member, and did not prevent already completed requests from being approved again. This makes it possible for authenticated attackers with vendor-level access to approve or reject other vendors' refund requests, creating real refunds on other stores' orders, altering their commissions, and repeatedly refunding the same order.

## References

- https://wpsec.com/vuln/WPSEC-2026-2371/
- https://plugins.svn.wordpress.org/wc-multivendor-marketplace/tags/3.8.4/
- https://wordpress.org/plugins/wc-multivendor-marketplace/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2371/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.