CVE-2026-7862: Critical Unauthenticated Refund Vulnerability in Eupago WooCommerce Plugin

Technical summary

CVE-2026-7862 is an improper access control vulnerability (CWE-284) in the Eupago Gateway For WooCommerce plugin affecting versions prior to 4.7.2. The refund request handler lacks authentication and authorization checks, permitting unauthenticated attackers to invoke refund operations against arbitrary WooCommerce orders using the merchant's stored payment gateway credentials. For payment methods supporting fund redirection, attackers can modify the destination bank account to siphon refunded amounts to attacker-controlled accounts.

Business impact

This vulnerability poses significant financial risk to WooCommerce merchants using Eupago. Attackers can drain funds by issuing fraudulent refunds to themselves, bypassing normal transaction controls. Beyond direct financial loss, compromised merchants face customer disputes, chargeback fees, potential processor sanctions, and reputational damage. The attack requires no authentication or user interaction, making it trivially exploitable at scale.

Affected systems

The Eupago Gateway For WooCommerce WordPress plugin in versions before 4.7.2 is vulnerable. WooCommerce storefronts integrating this payment gateway are at risk. The vulnerability is network-accessible and affects all affected installations regardless of security posture, provided the plugin remains unpatched.

Exploitability

This vulnerability is highly exploitable. It requires no authentication, no special privileges, and no user interaction. An attacker needs only network access and knowledge of target WooCommerce order IDs (often sequential or discoverable). The attack can be automated and executed repeatedly. The low CVSS attack complexity (AC:L) and lack of privileges required (PR:N) reflect this ease of exploitation.

Remediation

Merchants must immediately update the Eupago Gateway For WooCommerce plugin to version 4.7.2 or later. Verify the update through the WordPress plugin dashboard or directly with Eupago. As an interim mitigation before patching, consider disabling the plugin or restricting refund capabilities through WooCommerce settings if operationally feasible. Monitor recent transactions for suspicious refund activity.

Patch guidance

Update the Eupago Gateway For WooCommerce plugin to 4.7.2 or higher. Access WordPress admin > Plugins > check for updates, or manually upload the patched version. Test in a staging environment first to confirm payment processing continues normally. After deployment, verify the refund handler now enforces proper authentication by attempting unauthorized refund requests (which should now fail).

Detection guidance

Monitor WooCommerce refund logs and payment gateway activity for: refunds initiated outside normal business patterns, refunds processed to unfamiliar bank accounts, refund requests with no corresponding admin user action, and HTTP requests to the refund handler endpoint lacking valid session or nonce tokens. Enable detailed logging on the Eupago plugin if available. Review transaction reports from your payment processor for anomalies. Correlate refund timestamps with web server access logs to identify attacker IP ranges.

Why prioritize this

This vulnerability merits urgent patching due to its high CVSS score (8.6), trivial exploitability (no authentication required), and direct financial impact. It enables attackers to steal money from any WooCommerce store using Eupago without barriers. The lack of exploitation barriers and high-impact nature make this a critical risk for any affected merchant.

Risk score, explained

The CVSS 3.1 score of 8.6 (HIGH) reflects: network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), limited confidentiality impact through potential access to order data (C:L), high integrity impact from unauthorized refunds and account redirection (I:H), and low availability impact if refund abuse disrupts service (A:L). The score appropriately captures the severity of unauthenticated fund theft.

Frequently asked questions