Eupago Gateway for WooCommerce WordPress Plugin Access Control Vulnerability Allowing Unauthenticated Refunds

A vulnerability in the Eupago Gateway for WooCommerce WordPress plugin, affecting versions prior to 4.7.2, allows unauthenticated attackers to initiate refunds on any WooCommerce order. The plugin fails to properly restrict access to its refund request handler, enabling attackers to use the merchant's payment gateway credentials to process refunds. For certain payment methods, this vulnerability also allows redirected funds to an attacker-controlled bank account.

Impact

Exploitation of this vulnerability could lead to unauthorized refunds being processed, with refunded amounts redirected to an attacker-controlled bank account.

Remediation

Users are advised to update the Eupago Gateway for WooCommerce WordPress plugin to version 4.7.2 or later.