CVE-2026-77701: CWE-862 Missing Authorization in WCFM Marketplace
Description
WCFM Marketplace WordPress plugin versions 3.7.1 and earlier do not properly verify ownership of orders when processing refund requests. This flaw allows unauthenticated users to create refund requests for any guest checkout order on the site, potentially leading to unauthorized refund actions. The vulnerability is identified as CWE-862 (Missing Authorization).
CVSS v3.1
Score 5.3medium
Affected software
WCFM Marketplace
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The WCFM Marketplace WordPress plugin before version 3.8.2 contains a missing authorization vulnerability (CWE-862) that fails to confirm that the requester of a refund owns the order. This allows unauthenticated attackers to submit refund requests against any guest checkout order, bypassing intended access controls. The issue affects version 3.7.1 as explicitly stated. There is no vendor advisory or patch information provided, and no known exploits in the wild have been reported.
Potential Impact
An attacker can submit unauthorized refund requests for guest checkout orders without authentication. This could lead to improper refund processing and potential financial loss or administrative overhead for site operators. There is no indication of confidentiality or availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should consider restricting refund request functionality or implementing additional access controls to verify order ownership. Monitor for updates from the plugin vendor regarding patches.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-21T08:01:12.601Z
- State
- PUBLISHED
Threat ID: 6a913ad4acd9273b4992fa59
Added to database: 08/28/2026, 07:37:56 UTC
Last enriched: 09/10/2026, 03:23:26 UTC
Last updated: 10/13/2026, 18:48:23 UTC
Views: 99
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.