CVE-2026-1722

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1722", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-30T20:26:54.350Z", "datePublished": "2026-02-10T07:27:00.651Z", "dateUpdated": "2026-04-08T17:25:38.377Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:38.377Z"}, "affected": [{"vendor": "wclovers", "product": "WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.7.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings."}], "title": "WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d39ec46d-58c4-40e4-b94a-e7a9fc99291a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/trunk/core/class-wcfmmp-refund.php#L235"}, {"url": "https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/tags/3.7.0/core/class-wcfmmp-refund.php#L235"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3455829%40wc-multivendor-marketplace%2Ftrunk&old=3424081%40wc-multivendor-marketplace%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-862 Missing Authorization", "cweId": "CWE-862", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gibran Abdillah"}], "timeline": [{"time": "2026-02-03T12:31:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-09T18:54:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-10T15:34:36.609626Z", "id": "CVE-2026-1722", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:35:31.897Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1722", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-10T15:34:36.609626Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-10T15:34:40.447Z"}}], "cna": {"title": "WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation", "credits": [{"lang": "en", "type": "finder", "value": "Gibran Abdillah"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "affected": [{"vendor": "wclovers", "product": "WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.7.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-03T12:31:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-09T18:54:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d39ec46d-58c4-40e4-b94a-e7a9fc99291a?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/trunk/core/class-wcfmmp-refund.php#L235"}, {"url": "https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/tags/3.7.0/core/class-wcfmmp-refund.php#L235"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3455829%40wc-multivendor-marketplace%2Ftrunk&old=3424081%40wc-multivendor-marketplace%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862 Missing Authorization"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:38.377Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1722", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:25:38.377Z", "dateReserved": "2026-01-30T20:26:54.350Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-10T07:27:00.651Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce", "vendor": "wclovers", "versions": [{"lessThanOrEqual": "3.7.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WCFM Marketplace \u2013 Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization checks in the `wcfm-refund-requests-form` AJAX controller. This makes it possible for unauthenticated attackers to create arbitrary refund requests for any order ID and item ID, potentially leading to financial loss if automatic refund approval is enabled in the plugin settings."}, {"lang": "es", "value": "El plugin WCFM Marketplace \u2013 Multivendor Marketplace para WooCommerce para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 3.7.0, inclusive. Esto se debe a que el plugin no implementa comprobaciones de autorizaci\u00f3n en el controlador AJAX 'wcfm-refund-requests-form'. Esto hace posible que atacantes no autenticados creen solicitudes de reembolso arbitrarias para cualquier ID de pedido y ID de art\u00edculo, lo que podr\u00eda provocar p\u00e9rdidas financieras si la aprobaci\u00f3n autom\u00e1tica de reembolsos est\u00e1 habilitada en la configuraci\u00f3n del plugin."}], "id": "CVE-2026-1722", "lastModified": "2026-06-17T10:16:23.900", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1722", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-10T15:34:36.609626Z", "version": "2.0.3"}}]}, "published": "2026-02-10T08:15:56.307", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/tags/3.7.0/core/class-wcfmmp-refund.php#L235"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/trunk/core/class-wcfmmp-refund.php#L235"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3455829%40wc-multivendor-marketplace%2Ftrunk&old=3424081%40wc-multivendor-marketplace%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d39ec46d-58c4-40e4-b94a-e7a9fc99291a?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.7.0]"}}], "product": "wcfm_marketplace_\u2013_multivendor_marketplace_for_woocommerce", "vendor": "wclovers"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T01:04:16.262989+00:00", "value": {"mitigation_remediation": ["Update the WCFM Marketplace plugin to a non\u2011vulnerable version newer than 3.7.0 that includes the missing authorization check for refund requests.", "If an update is not immediately possible, disable the automatic refund approval setting in the plugin to prevent unsigned refunds from being processed.", "Restrict access to the refund request endpoint by ensuring it is only reachable by authenticated vendor users, or temporarily disable the refund feature until the patch is applied."], "summary": {"action": "Immediate Patch", "impact": "Financial loss via unauthorized refunds"}, "threat_synthesis": {"affected_systems": "This weakness affects all releases of the WCFM Marketplace plugin from its initial version through 3.7.0. The product is offered by the vendor wclovers and is used to create a multi\u2011vendor marketplace within WooCommerce sites. No other versions beyond 3.7.0 are listed as vulnerable in the supplied data, and no other vendors are named.", "description_and_impact": "The vulnerability is an Insecure Direct Object Reference in the WCFM Marketplace WordPress plugin. It is a CWE\u2011862 (Missing Authorization Check) vulnerability. The AJAX controller that handles refund requests does not perform an authorization check, so anyone can send a request with an arbitrary order and item identifier to create a refund entry. When an attacker triggers this, the refund record appears as if created by the rightful vendor, potentially leading to a financial loss if the plugin\u2019s automatic approval setting is enabled.", "risk_and_exploitability": "The CVSS score of 5.3 indicates moderate severity, and the EPSS score, now less than 1\u202f%, indicates that the probability of exploitation is low as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that attackers reach the vulnerable endpoint without authentication, using a crafted AJAX call over HTTP or HTTPS. If the plugin\u2019s automatic refund approval is turned on, the attacker could achieve a fully automated refund, which could be abused to generate unnecessary payouts."}}}}, "created": "2026-02-10T11:34:25.336758+00:00", "updated": "2026-04-16T01:15:20.521759+00:00", "vendors": ["wclovers", "wclovers$PRODUCT$wcfm_marketplace_\u2013_multivendor_marketplace_for_woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}