The vulnerability is an Insecure Direct Object Reference in the WCFM Marketplace WordPress plugin. It is a CWE‑862 (Missing Authorization Check) vulnerability. The AJAX controller that handles refund requests does not perform an authorization check, so anyone can send a request with an arbitrary order and item identifier to create a refund entry. When an attacker triggers this, the refund record appears as if created by the rightful vendor, potentially leading to a financial loss if the plugin’s automatic approval setting is enabled.

This weakness affects all releases of the WCFM Marketplace plugin from its initial version through 3.7.0. The product is offered by the vendor wclovers and is used to create a multi‑vendor marketplace within WooCommerce sites. No other versions beyond 3.7.0 are listed as vulnerable in the supplied data, and no other vendors are named.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score, now less than 1 %, indicates that the probability of exploitation is low as of the latest data. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is that attackers reach the vulnerable endpoint without authentication, using a crafted AJAX call over HTTP or HTTPS. If the plugin’s automatic refund approval is turned on, the attacker could achieve a fully automated refund, which could be abused to generate unnecessary payouts.