CVE-2026-77701

MediumCVSS 5.3

Published: 28/08/2026(UTC)Updated: 28/08/2026(UTC)Translated: 28/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

12th percentile - higher than 12% of all known CVEs

Summary

The WCFM Marketplace WordPress plugin before version 3.8.2 does not correctly verify that the person requesting a refund owns the order. This allows unauthenticated users to create refund requests against any guest checkout order on the site.

Risk Assessment

An attacker could generate fraudulent refund requests, potentially leading to financial losses and disruption of order processing.

Recommendation

Update the WCFM Marketplace plugin to version 3.8.2 or later, which includes the order ownership verification fix.

Other vulnerabilities in WCFM Marketplace WordPress plugin

CVE-2026-14196Medium
The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.

Original NVD description (English source)

The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.