CVE-2026-77701 in WCFM Marketplace Plugin
Summary
by MITRE • 08/28/2026
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in versions of the WCFM Marketplace WordPress plugin prior to version 3.8.2 represents a critical failure in access control and object ownership verification within an e-commerce environment. This flaw specifically impacts the functionality that allows customers or administrators to process refund requests for orders placed via guest checkout methods. In typical web application security, it is imperative that any action modifying state, such as initiating a financial transaction reversal like a refund, must be strictly bound to the authenticated identity of the user who initiated the original purchase. The absence of this verification mechanism creates a significant gap in the integrity controls governing order management data.
From a technical perspective, the core issue lies in how the plugin handles input validation for refund requests. When an unauthenticated or arbitrary user submits a request to process a refund against a specific order identifier, the application logic fails to cross-reference that order with any existing customer account or session context associated with it. Instead of verifying that the requester is the legitimate owner of the transaction data being modified, the system accepts the input based solely on the presence of valid parameters for the refund action. This lack of server-side authorization checks allows an attacker to manipulate the request payload to target arbitrary order IDs found through enumeration or other means, effectively bypassing any intended restrictions on who can initiate financial reversals.
The operational impact of this vulnerability is severe due to its potential for direct financial loss and data integrity compromise. An unauthenticated actor could theoretically generate refund requests against any guest checkout order present in the system's database. While the actual execution of a monetary transfer might depend on subsequent administrative approval or payment gateway configurations, the ability to inject false refund claims can disrupt inventory management systems, skew sales analytics, and create confusion for store administrators who must manually review these fraudulent requests. Furthermore, this behavior demonstrates a fundamental misunderstanding of state machine transitions in e-commerce workflows, where actions should be strictly gated by user identity and role-based permissions rather than open access to transactional endpoints.
This vulnerability aligns with CWE-284, which describes Improper Access Control, as the application fails to restrict resources based on authorization levels or ownership attributes. It also maps closely to MITRE ATT&CK technique T1530, Data from Information Repositories, in contexts where an attacker might probe for order details, and more critically relates to privilege escalation concepts within a single-user context by allowing unauthorized modification of data belonging to others. The flaw is particularly dangerous because it exploits the trust placed in guest checkout processes, which are often designed with fewer security checks than logged-in user flows but still require basic integrity protections against external manipulation.
To mitigate this risk, immediate action must be taken to upgrade the WCFM Marketplace plugin to version 3.8.2 or later, where these access control mechanisms have been corrected. In environments where upgrading is not immediately feasible, administrators should implement strict input validation and server-side authorization checks that verify the current user session matches the customer ID associated with the order being refunded. Additionally, enabling two-factor authentication for administrative accounts can reduce the risk of an attacker exploiting any secondary vulnerabilities to gain higher privileges after manipulating refund requests. Regular security audits focusing on object-level permissions in e-commerce plugins are essential to prevent similar logic flaws from persisting in complex web applications that handle sensitive financial data.