Executive brief
WCFM Marketplace is a WordPress plugin that enables multi-vendor marketplaces with refund request functionality. The plugin fails to properly verify order ownership, allowing unauthenticated users to create refund requests for any guest checkout order on the site. This can lead to fraudulent refund requests, disruption of legitimate transactions, and reputational damage to the marketplace.
Technical details
This is a broken access control vulnerability (CWE-862) in the refund request processing controller. The root cause is a flawed ownership check: the controller compares $order->get_customer_id() == $current_user_id, which evaluates to 0 == 0 for both guest orders and unauthenticated visitors, allowing the bypass. The vulnerability is exposed via the wp_ajax_nopriv_wcfm_ajax_controller endpoint, which does not require authentication. An attacker can enumerate sequential guest order IDs, extract a wcfm_ajax_nonce from any public page, and submit a POST request to create refund requests. The item ID is taken directly from attacker input without validation that it belongs to the specified order. This affects WCFM Marketplace versions before 3.8.2; the vulnerability was fixed in version 3.8.2.
Affected products
- WCFM WCFM Marketplace before 3.8.2
Timeline
- 2026-08-26: disclosed
- 2026-08-28: patched: Fixed in version 3.8.2
- 2026-08-28: advisory