{"id":"CVE-2026-77701","aliases":["EUVD-2026-67571","GHSA-m58g-jhp8-rgr8"],"status":"published","title":"WCFM Marketplace \u003c 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders","description":"The WCFM Marketplace  WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00304,"percentile":0.23432,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2026-08-28T06:00:16Z","modified":"2026-08-28T18:40:31Z","products":[{"vendor":"unknown","product":"wcfm marketplace"},{"vendor":"wc lovers","product":"wcfm marketplace"}],"references":[{"url":"https://wpscan.com/vulnerability/38195936-5dc2-474f-84e5-fdcc0b39caca/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77701"},{"url":"https://wpscan.com/vulnerability/38195936-5dc2-474f-84e5-fdcc0b39caca"},{"url":"https://github.com/advisories/GHSA-m58g-jhp8-rgr8"}],"sources":{"cve":[{"id":"CVE-2026-77701","title":"WCFM Marketplace \u003c 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders","description":"The WCFM Marketplace  WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.","status":"published","published":"2026-08-28T06:00:16.799Z","modified":"2026-08-28T13:03:20.688Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:20:16.072351Z"}],"euvd":[{"id":"EUVD-2026-67571","description":"The WCFM Marketplace  WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.","status":"published","published":"2026-08-28T06:00:16Z","modified":"2026-08-28T13:03:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:23.608347Z"}],"ghsa":[{"id":"GHSA-m58g-jhp8-rgr8","title":"The WCFM Marketplace  WordPress plugin before 3.8.2 does not correctly verify that the person...","description":"The WCFM Marketplace  WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.","status":"published","published":"2026-08-28T09:31:45Z","modified":"2026-08-28T18:31:28Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:11:07.541511Z"}],"nvd":[{"id":"CVE-2026-77701","description":"The WCFM Marketplace  WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.","status":"published","published":"2026-08-28T08:16:41.587Z","modified":"2026-08-28T18:40:31.63Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:12:42.035353Z"}]}}