WordPress Plugin Vulnerabilities

WC Buckaroo BPE Gateway < 4.9.0 - Subscriber+ Unauthorized Order Refund

Description

The plugin does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.

Proof of Concept

Affects Plugins

Plugin icon
wc-buckaroo-bpe-gateway
Fixed in 4.9.0

References

CVE
CVE-2026-13329

Classification

Type
ACCESS CONTROLS
OWASP top 10
A5: Broken Access Control
CWE
CWE-284
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Vaibhav Narkhede
Submitter
Vaibhav Narkhede
Verified
Yes
WPVDB ID
6e60d271-574d-4259-ab51-32a014e480d4

Timeline

Publicly Published
2026-07-20 (about 6 days ago)
Added
2026-07-20 (about 6 days ago)
Last Updated
2026-07-20 (about 6 days ago)

Other

Published
Title
Published
2021-03-17
Title
WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts
Published
2022-05-18
Title
JupiterX Core < 2.0.7 - Information Disclosure, Modification, and Denial of Service
Published
2021-10-06
Title
Phoenix Media Rename < 3.4.4 - Author Arbitrary Media File Renaming
Published
2022-02-22
Title
Advanced Contact form 7 DB < 1.8.7 - Subscriber+ Arbitrary File Deletion
Published
2022-01-06
Title
Ultimate Product Catalog < 5.0.26 - Subscriber+ Arbitrary Product Creation & Settings Update