What is GHSA-63p2-7wgc-gxrq?

GHSA-63p2-7wgc-gxrq is a security advisory published by GitHub Security Advisories with Medium severity. The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any...

Which CVE IDs does GHSA-63p2-7wgc-gxrq cover?

GHSA-63p2-7wgc-gxrq covers the following CVE IDs: CVE-2026-13329. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-63p2-7wgc-gxrq?

GHSA-63p2-7wgc-gxrq has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-63p2-7wgc-gxrqMediumCVSS 6.5

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any...

Vendor

GitHub Security Advisories

Published

August 1, 2026

Last Modified

August 3, 2026

🔗 CVE IDs covered (1)

CVE-2026-13329 →

📋 Description

The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-13329
https://wpscan.com/vulnerability/6e60d271-574d-4259-ab51-32a014e480d4
https://github.com/advisories/GHSA-63p2-7wgc-gxrq