Buckaroo Payments for WooCommerce
Buckaroo Payments for WooCommerce has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of October 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Missing Authorization, behind 1 of the records (100%).
The one issue recorded for Buckaroo Payments for WooCommerce has a vendor fix available, so running the current release closes it.
All of these findings were reported by Vaibhav Narkhede. Buckaroo Payments for WooCommerce is installed on roughly 2,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2026-13329WC Buckaroo BPE Gateway <= 4.8.0 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Order Refund
Read the full analysisVulnerability Records

Buckaroo Payments for WooCommerce
Author
Rene Licher (Buckaroo)
Buckaroo Payments for WooCommerce connects your webshop to the Buckaroo payment platform. You offer the local and international payment methods your customers already trust, and you manage every transaction, refund and payout from one place. The plugin is built and maintained by Buckaroo, so new payment methods, logos and platform updates reach your shop without custom development work. Sell to more customers Local favourites and international methods side by side, from a single Buckaroo account. Buy now, pay later options so customers can pay after delivery or spread the cost. Express buttons on the product page, cart and checkout, so wallet users can pay in a few taps. Payment methods are shown only when they apply to the customer’s currency and country, which keeps the checkout clean. Fits the shop you already run Works with both the block-based checkout and the classic checkout. Compatible with High-Performance Order Storage. Available in several languages, with the payment page following the customer’s language. Optional payment fees per method, applied to the order total. Less work in the Administration Automatic Configuration checks your Buckaroo subscriptions and sets up the matching payment methods for you. Full and partial refunds straight from the WooCommerce order screen, with the order status kept in sync. Order statuses updated automatically through Buckaroo push messages. Send a payment request to a customer with PayPerEmail or a PayLink, without leaving the order screen. Test mode per payment method, with a clear notice in the Administration while a method is still in test. Supported payment methods Alipay Apple Pay Bancontact Belfius Billink Bizum Blik Cards (American Express, Visa, Mastercard, VPAY, Visa Electron, Maestro, Carte Bleue, Carte Bancaire, Dankort, Nexi, PostePay) EPS Giftcards Google Pay iDEAL | Wero In3 KBC Klarna MB Way Multibanco PayByBank PayPal PayPerEmail Przelewy24 Riverty SEPA Credit Transfer (bank transfer) SEPA Direct Debit Swish Trustly Twint WeChat Pay Wero (BE, DE, FR) Zakelijk op rekening (ABN AMRO) Which methods you can offer depends on the subscriptions active on your Buckaroo account. Before you start You need a Buckaroo account to use this plugin. Create one via buckaroo.eu (English) or buckaroo.nl (Dutch). Once your account is active, you configure the plugin with the Store key, Secret key and Merchant key from your Buckaroo Plaza. Documentation and support Step by step setup instructions are in the WooCommerce installation guide. The source code and release notes are on GitHub. External services This plugin connects your shop to the Buckaroo payment platform in order to create, process and refund payments. Without this connection the plugin cannot function. Data is sent to Buckaroo when a customer places an order with a Buckaroo payment method, and when you refund or capture an order from the WordPress Administration. Depending on the payment method, this can include the order number and amount, the currency, the billing and shipping address, the customer name, email address, phone number and, for buy now, pay later methods, the order lines and date of birth. Buckaroo also sends push messages back to your shop to report the status of a transaction. Service provided by Buckaroo B.V.: terms and conditions and privacy statement. Contact Questions about your account or subscriptions: wecare@buckaroo.nl or +31 (0)30 711 50 00. Technical questions about the plugin: support@buckaroo.nl.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C