WCFM Marketplace Insecure Direct Object Reference Vulnerability Allowing Arbitrary Refund Requests

A vulnerability exists in the WCFM Marketplace - Multivendor Marketplace for WooCommerce plugin for WordPress, specifically in versions up to and including 3.7.0. The issue arises from the absence of proper authorization checks in the 'wcfm-refund-requests-form' AJAX controller. This flaw enables unauthenticated attackers to create arbitrary refund requests for any order ID and item ID. If the plugin is configured to automatically approve refunds, this vulnerability could result in financial losses.

Impact

Exploitation of this vulnerability could lead to unauthorized refund requests being created, potentially causing financial loss to the affected party, especially if automatic refund approval is enabled in the plugin settings.

Remediation

Users can update to version 3.7.1 or a newer patched version to address this vulnerability.