Access Control Flaw in Eupago Gateway for WooCommerce Plugin by WordPress
CVE-2026-7862
What is CVE-2026-7862?
The Eupago Gateway for WooCommerce plugin prior to version 4.7.2 features a significant security flaw where access control mechanisms are inadequately enforced. This allows unauthorized individuals to exploit the refund request handler, enabling them to initiate refunds on any WooCommerce order. Through this vulnerability, attackers can manipulate the merchant's payment gateway credentials and potentially redirect refunded amounts to bank accounts they control. It is crucial for WooCommerce users employing the Eupago Gateway plugin to update to the latest version to safeguard their transactions and financial assets.
Affected Version(s)
Eupago Gateway For Woocommerce 0 < 4.7.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.