CVE-2026-81799
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The WP Swings Return Refund and Exchange For WooCommerce plugin through version 4.6.4 contains a missing authorization vulnerability. Incorrectly configured access control security levels can be exploited.
Risk Assessment
An attacker could perform actions reserved for authorized users, potentially leading to unauthorized changes in refund and exchange handling within the WooCommerce store.
Recommendation
Update the Return Refund and Exchange For WooCommerce plugin to a version newer than 4.6.4 and review the store's permission configuration.
Other vulnerabilities in Return Refund and Exchange For WooCommerce
See all- CVE-2026-77695Medium
The Return Refund and Exchange For WooCommerce WordPress plugin before version 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users. This allows them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
- CVE-2025-12881Medium
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
- CVE-2025-12086Medium
The Return Refund and Exchange For WooCommerce plugin for WordPress up to version 4.5.5 is vulnerable to Insecure Direct Object Reference in the AJAX endpoint 'wps_rma_cancel_return_request' due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to delete other users' refund requests.
Original NVD description (English source)
Missing Authorization vulnerability in WP Swings Return Refund and Exchange For WooCommerce woo-refund-and-exchange-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Return Refund and Exchange For WooCommerce: from n/a through 4.6.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS