The Eupago Gateway For Woocommerce WordPress plugin prior to version 4.7.2 does not properly restrict access to its refund request handler, classified under CWE-284 (Improper Access Control). This vulnerability allows unauthenticated attackers to trigger refunds on any WooCommerce order processed through the plugin, leveraging the merchant's payment gateway credentials. Additionally, for payment methods that support it, attackers can redirect the refunded money to accounts they control, potentially resulting in financial loss to the merchant. The vulnerability is publicly disclosed but lacks an assigned CVSS score and no official patch or remediation level has been provided yet.

Successful exploitation of this vulnerability could lead to unauthorized refunds being processed without merchant consent, resulting in direct financial loss. Attackers may also redirect funds to their own bank accounts for applicable payment methods, increasing the risk of fraud and monetary theft. There are no reports of active exploitation in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to monitor plugin updates closely and apply any released patches promptly. Restricting access to the refund functionality through additional access controls or disabling the plugin if not essential may reduce risk temporarily.