The Buckaroo Woocommerce Payments Plugin for WordPress versions 4.8.x and earlier contains a missing capability check and nonce validation in its AJAX refund processing routine. The back‑end action that captures refunds performs no verification of the user’s privileges, allowing any authenticated user—including those with Subscriber roles—to invoke the refund API. This results in unauthorized, potentially repeated, payment refunds on orders that have already been captured, compromising the financial integrity of the site.

All WordPress sites that have the Buckaroo Woocommerce Payments Plugin installed and use versions earlier than 4.9.0 are impacted. The vulnerability is confined to the plugin’s refund endpoint and does not affect core WordPress components or other plugins directly. Users with any logged‑in role that is granted access to the plugin can trigger the exploit.

The exploit requires the attacker to possess a legitimate WordPress account, but no additional high‑privilege permissions are needed because the plugin does not enforce a capability check. The EPSS score of < 1 % and the fact that the vulnerability is not listed in the CISA KEV catalog suggest a low current exploitation probability; however, the impact is significant, as an attacker could generate financial loss through unauthorized refunds. The issue represents improper access control and aligns with CWE‑284. Administrators should treat the vulnerability as serious, especially in environments where financial transactions are processed through the plugin. The CVSS score of 6.5 indicates significant risk.