CVE-2024-7386 is a CSRF vulnerability in the Premium Packages – Sell Digital Products Securely WordPress plugin (up to version 5.9.1). The root cause is the absence of nonce validation on the addRefund() function, which processes refund requests. Without this protection, attackers can craft malicious requests that, when executed by an authenticated administrator or shop manager, trigger unauthorized refund operations. The vulnerability requires user interaction (UI:R) but no privileges (PR:N) and can be exploited remotely (AV:N).

Exploitation of this vulnerability allows an attacker to cause an authenticated administrator or shop manager to perform refund actions without their intent, potentially leading to unauthorized financial transactions or loss of revenue. There is no impact on confidentiality or availability, only integrity is affected at a low level. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should exercise caution with links and requests related to refund actions and consider restricting administrative access or implementing additional CSRF protections manually if possible.