Executive brief
The Buckaroo WooCommerce Payments plugin, which facilitates payment processing for WordPress e-commerce sites, contains a security flaw in its refund handling. This vulnerability allows any logged-in user, such as a basic subscriber or customer, to trigger unauthorized refunds for completed orders. This could lead to significant financial loss and operational disruption for online merchants.
Technical details
The Buckaroo WooCommerce Payments plugin (wc-buckaroo-bpe-gateway) before version 4.9.0 is vulnerable to an improper access control flaw. Specifically, the plugin fails to perform capability checks or nonce validation on the AJAX action responsible for processing payment capture refunds. An attacker authenticated with low-level privileges (such as a Subscriber) can send a crafted AJAX request to trigger refunds against captured orders. This is classified as a missing authorization (CWE-284) and missing anti-CSRF mechanism (CWE-352) issue. The vulnerability is resolved in version 4.9.0.
Affected products
- Buckaroo Buckaroo Woocommerce Payments Plugin < 4.9.0
Timeline
- 2026-07-20: disclosed
- 2026-08-01: advisory: NVD publication date
- 2026-08-01: patched: Fixed in version 4.9.0