CVE-2026-7862

The Eupago Gateway For Woocommerce WordPress plugin (versions prior to 4.7.2 ) contains an improper access control vulnerability in its refund request handler . This flaw allows unauthenticated attackers to initiate refunds for any WooCommerce order using the merchant's payment gateway credential...

PT-2026-44207

Name of the Vulnerable Software and Affected Versions Eupago Gateway For Woocommerce WordPress plugin versions prior to 4.7.2 Description The plugin fails to properly restrict access to its refund request handler. This allows unauthenticated attackers to initiate refunds for any WooCommerce order...

Improper Authorization

shopware/core is vulnerable to Improper Authorization. The vulnerability is due to refunds being disabled only at the UI level via the core.cart.enableOrderRefunds setting, which allows an attacker to bypass restrictions by sending a custom crafted request to cancel their own orders...

CVE-2024-13641

The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for...