Vulnerability · Published May 28, 2026 · Assigned by WPScan

CVE-2026-7862Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation

High 8.6

In plain English

A high-severity improper access control in Eupago Gateway For Woocommerce from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.2%top 88.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated attackers to initiate refunds against any WooCommerce order using the merchant's payment gateway credentials, and for applicable payment methods, to redirect refunded funds to an attacker-controlled bank account.

Affected products (as reported)

Vendor	Product	Versions
Unknown	Eupago Gateway For Woocommerce	0 – before 4.7.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

References

https://wpscan.com/vulnerability/b4ce2a06-b435-4b77-851f-4406f2a91ca6/ exploit, vdb-entry, technical-description