CyberRota Analysis
AI-GeneratedThe Buckaroo Woocommerce Payments Plugin for WordPress prior to version 4.9.0 is vulnerable due to a lack of capability checks and nonce validation on an AJAX action, enabling any authenticated user, including those with minimal permissions like Subscribers, to initiate refunds on captured orders. This could lead to unauthorized financial transactions and potential revenue loss for businesses using the plugin. WordPress site administrators and e-commerce operators should prioritize updating to the latest version to mitigate this risk.
Original NVD Description
The Buckaroo Woocommerce Payments Plugin WordPress plugin before 4.9.0 does not perform any capability check or nonce validation on an AJAX action that processes payment capture refunds, allowing any authenticated user, including Subscribers, to trigger refunds against captured orders.