Improper Input Validation in Buckaroo Woocommerce Payments Plugin for WordPress
CVE-2026-13329
What is CVE-2026-13329?
The Buckaroo Woocommerce Payments Plugin for WordPress prior to version 4.9.0 contains a vulnerability that stems from the lack of proper capability checks and nonce validation on an AJAX action responsible for processing refunds on captured payments. This flaw allows any authenticated user, including those with Subscriber-level access, to initiate refund requests, potentially leading to unauthorized financial transactions. As a result, businesses utilizing this plugin may be exposed to significant risks regarding payment integrity and fraud.
Affected Version(s)
Buckaroo Woocommerce Payments Plugin 0 < 4.9.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.