CVE-2026-7862
Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation
Vexday Risk Score
41Attention
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS 8.6EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —
Lifecycle
28 May 2026Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The Eupago Gateway For Woocommerce WordPress plugin before 4.7.2 does not properly restrict access to its refund request handler, allowing unauthenticated attackers to initiate refunds against any WooCommerce order using the merchant's payment gateway credentials, and for applicable payment methods, to redirect refunded funds to an attacker-controlled bank account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Affected products
Unknown · Eupago Gateway For Woocommercepublic PoCs found — 1
cve_referencewpscan.com/vulnerability/b4ce2a06-b435-4b77-851f-4406f2a91ca6/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.