CVE-2026-7862: Eupago Gateway For Woocommerce < 4.7.2 - Unauthenticated Arbitrary Refund Initiation

Synopsis

An unauthenticated arbitrary refund initiation vulnerability exists in the Eupago Gateway For WooCommerce WordPress plugin before version 4.7.2. The plugin's refund request handler is reachable over the network without any login or credentials, allowing any attacker to trigger it directly. Successful exploitation lets an attacker force refunds on arbitrary WooCommerce orders using the merchant's own payment gateway credentials, and in some payment method configurations, redirect refunded funds to an attacker-controlled bank account. A patched-image rebuild at version 4.7.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable refund handler is exposed over the network, so an attacker must be able to reach the WordPress site's HTTP endpoint from the internet or an internal network.

• AuthenticationNot required

  No account, session, or credentials of any kind are required; the refund handler accepts unauthenticated requests.

• Victim interactionNot required

  The attacker sends requests directly to the vulnerable endpoint; no user action or social engineering is needed.

• Attack complexityDetail

  Exploitation is straightforward and condition-free; no race conditions, special memory layout, or timing requirements are involved.

Blast Radius

• Reads limited order metadata and transaction identifiers associated with any WooCommerce order, exposing partial customer and payment information.
• Forces refund transactions on arbitrary orders using the merchant's own payment gateway credentials, directly reversing revenue.
• Redirects refunded funds to an attacker-controlled bank account for payment methods that support beneficiary redirection, resulting in direct financial theft from the merchant.
• Causes partial service disruption by invalidating order states and triggering downstream fulfillment or accounting workflow errors tied to unexpected refund events.