CVE-2026-13329 Overview
CVE-2026-13329 is a broken access control vulnerability [CWE-284] in the Buckaroo WooCommerce Payments Plugin for WordPress. Versions before 4.9.0 fail to perform capability checks or nonce validation on an AJAX action that processes payment capture refunds. Any authenticated user, including low-privileged Subscribers, can trigger refunds against captured orders. The flaw allows attackers with minimal account access to cause financial loss to merchants by issuing unauthorized refunds on legitimate transactions.
Critical Impact
Authenticated Subscriber-level users can invoke the vulnerable AJAX endpoint to issue arbitrary refunds against captured WooCommerce orders without authorization or CSRF protection.
Affected Products
- Buckaroo WooCommerce Payments Plugin for WordPress versions prior to 4.9.0
Discovery Timeline
- 2026-08-01 - CVE-2026-13329 published to NVD
- 2026-08-03 - Last updated in NVD database
Technical Details for CVE-2026-13329
Vulnerability Analysis
The Buckaroo WooCommerce Payments Plugin exposes an AJAX endpoint that handles payment capture refund operations. The handler processes requests without verifying the caller's WordPress capability and without validating a nonce token. WordPress AJAX actions registered under the wp_ajax_ prefix are accessible to every authenticated user by default, so the missing checks expose the refund functionality to the entire user base of a WordPress site.
This represents a classic broken access control weakness [CWE-284]. On WooCommerce stores that allow customer registration, any Subscriber account, including self-registered ones, can invoke the vulnerable action. The result is unauthorized refund initiation against orders that have already been captured, causing direct financial impact to the merchant.
Root Cause
The root cause is the absence of two standard WordPress security controls in the AJAX handler. First, the code does not call current_user_can() to verify that the requester holds an appropriate capability such as manage_woocommerce. Second, the handler omits check_ajax_referer() or an equivalent nonce validation, which would bind the request to a trusted origin and session.
Attack Vector
An attacker registers or compromises a low-privileged WordPress account on the target site. The attacker then sends a crafted POST request to admin-ajax.php targeting the vulnerable Buckaroo refund action, supplying an order identifier for a captured transaction. The plugin processes the refund without confirming authorization, and the payment processor issues funds back to the original order payer. Refer to the WPScan Vulnerability Report for additional technical detail.
Detection Methods for CVE-2026-13329
Indicators of Compromise
- Unexpected refund entries in WooCommerce order history that do not correspond to customer support tickets or admin actions.
- POST requests to /wp-admin/admin-ajax.php referencing Buckaroo refund actions originating from non-administrator user sessions.
- Payment gateway logs showing capture refund calls initiated outside normal business hours or from Subscriber accounts.
Detection Strategies
- Audit WordPress access logs for AJAX requests referencing the Buckaroo plugin action name, correlating requester user role with the action performed.
- Alert on any WooCommerce refund transaction where the initiating user does not hold the shop_manager or administrator role.
- Review Buckaroo merchant dashboard for refund volumes and patterns that deviate from historical baselines.
Monitoring Recommendations
- Forward WordPress and WooCommerce audit logs to a centralized SIEM for correlation with payment gateway events.
- Monitor creation of new Subscriber accounts followed by administrative-style AJAX activity within short time windows.
- Track the installed version of the Buckaroo plugin across managed WordPress instances and alert on versions below 4.9.0.
How to Mitigate CVE-2026-13329
Immediate Actions Required
- Update the Buckaroo WooCommerce Payments Plugin to version 4.9.0 or later on all affected WordPress sites.
- Review recent WooCommerce refund activity for unauthorized transactions and reconcile against the Buckaroo merchant portal.
- Audit WordPress user accounts and remove unused or suspicious Subscriber-level accounts.
Patch Information
The vendor addressed the issue in Buckaroo WooCommerce Payments Plugin version 4.9.0. The fix adds capability checks and nonce validation to the AJAX handler that processes payment capture refunds. See the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the Buckaroo WooCommerce Payments Plugin until the patched version can be deployed if immediate updates are not possible.
- Restrict new user registration on the WordPress site by disabling the "Anyone can register" option under General Settings.
- Apply web application firewall rules that block unauthenticated or low-privileged access to admin-ajax.php requests targeting Buckaroo refund actions.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
