Return Refund and Exchange For WooCommerce vulnerabilities

The WP Swings Return Refund and Exchange For WooCommerce plugin through version 4.6.4 contains a missing authorization vulnerability. Incorrectly configured access control security levels can be exploited.

The Return Refund and Exchange For WooCommerce WordPress plugin before version 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users. This allows them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.

The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.

The Return Refund and Exchange For WooCommerce plugin for WordPress up to version 4.5.5 is vulnerable to Insecure Direct Object Reference in the AJAX endpoint 'wps_rma_cancel_return_request' due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to delete other users' refund requests.