CVE-2026-77695
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Return Refund and Exchange For WooCommerce WordPress plugin before version 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users. This allows them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
Risk Assessment
The risk includes customer privacy breaches, impersonation of customers, and manipulation of the return process. Attackers could also disrupt store operations or cause financial damage.
Recommendation
Update the Return Refund and Exchange For WooCommerce plugin to version 4.6.4 or later. Also review AJAX logs and verify access permissions for guest orders.
Other vulnerabilities in Return Refund and Exchange For WooCommerce
See all- CVE-2026-81799High
The WP Swings Return Refund and Exchange For WooCommerce plugin through version 4.6.4 contains a missing authorization vulnerability. Incorrectly configured access control security levels can be exploited.
- CVE-2025-12881Medium
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
- CVE-2025-12086Medium
The Return Refund and Exchange For WooCommerce plugin for WordPress up to version 4.5.5 is vulnerable to Insecure Direct Object Reference in the AJAX endpoint 'wps_rma_cancel_return_request' due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to delete other users' refund requests.
Original NVD description (English source)
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS