PT-2026-7240 · WordPress+1 · Wcfm Marketplace+1

Gibran Abdillah · Published 2026-02-10 · Updated 2026-02-10 · CVE-2026-1722

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin versions prior to 3.7.1

Description The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is susceptible to an Insecure Direct Object Reference issue. The plugin does not implement proper authorization checks within the wcfm-refund-requests-form AJAX controller. This allows unauthenticated attackers to generate refund requests for any order ID and item ID. If automatic refund approval is enabled, this could result in financial loss. The vulnerable component allows attackers to bypass authorization controls and directly access and manipulate refund requests.

Recommendations Update the plugin to a version prior to 3.7.1.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-1722

Affected Products

Wcfm Marketplace

Woocommerce

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1722 · Security Note
• https://t.me/CVEtracker/44284 · Telegram Post
• https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/trunk/core/class-wcfmmp-refund.php#L235 · Note
• https://twitter.com/MNovofastovsky/status/2021157694283931910 · Twitter Post
• https://twitter.com/CVEnew/status/2021139803362766904 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d39ec46d-58c4-40e4-b94a-e7a9fc99291a?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3455829%40wc-multivendor-marketplace%2Ftrunk&old=3424081%40wc-multivendor-marketplace%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/wc-multivendor-marketplace/tags/3.7.0/core/class-wcfmmp-refund.php#L235 · Note
• https://twitter.com/VulmonFeeds/status/2021160524558283225 · Twitter Post
• https://t.me/cveNotify/151527 · Telegram Post