Buckaroo lets Subscribers trigger captured-order refunds
Buckaroo Woocommerce Payments Plugin before 4.9.0 exposes a payment-capture refund AJAX action without a capability check or nonce validation. Any authenticated Subscriber-or-higher user can select a captured WooCommerce order and trigger a refund through the site's payment integration. The published record does not disclose the AJAX action, order or transaction parameter, callback, refund amount behavior or processor method.
- Component
- Buckaroo Woocommerce Payments Plugin
- Plugin slug
buckaroo-woocommerce-payments-plugin- Affected
- < 4.9.0
- Safe version
4.9.0- Published
- Aug 01, 2026
- Weakness
- Not assigned
This CVE was published Aug 01, 2026 and is one of 1 known issue for this plugin.
Update, patch or deactivate.
Update Buckaroo Woocommerce Payments Plugin to 4.9.0 or later. Reconcile refunds with authorized merchant records, review authenticated AJAX activity by low-privileged accounts, contact the payment processor about unauthorized reversals, and restrict or remove suspicious accounts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.