Eupago Gateway For Woocommerce Vulnerabilities

The Eupago Gateway For Woocommerce plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 4.7.1. This is due to missing nonce verification and capability check on the wp_ajax_nopriv_refund AJAX action in the refund_func function. This makes it possible for unauthenticated attackers...

CVSS:

5.3

Affected:

up to 4.7.1

Fixed in:

4.7.2

Disclosed:

May 7, 2026

CVE-2026-7862 on NVD →

[en] Missing Authorization vulnerability in Eupago Eupago Gateway For Woocommerce eupago-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eupago Gateway For Woocommerce: from n/a through <= 4.6.3.

Affected:

up to 4.6.3

Fix:

No patched version reported

Disclosed:

Dec 9, 2025

CVE-2025-62870 on NVD →

The Eupago Gateway For Woocommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.7.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 4.7.1

Fixed in:

4.7.2

Disclosed:

Dec 8, 2025

CVE-2025-62870 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in euPago Eupago Gateway For Woocommerce plugin <= 3.1.9 versions.

Affected:

up to 3.1.10

Fixed in:

3.1.10

Disclosed:

Oct 16, 2023

CVE-2023-45638 on NVD →

The Eupago Gateway For Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.9. This is due to missing or incorrect nonce validation on the eupago_page_content function. This makes it possible for unauthenticated attackers to update plugin settings via a forg...

CVSS:

4.3

Affected:

up to 3.1.9

Fixed in:

3.1.10

Disclosed:

Oct 12, 2023

CVE-2023-45638 on NVD →