CVE-2025-12086
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Return Refund and Exchange For WooCommerce plugin for WordPress up to version 4.5.5 is vulnerable to Insecure Direct Object Reference in the AJAX endpoint 'wps_rma_cancel_return_request' due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to delete other users' refund requests.
Risk Assessment
An attacker can delete other users' refund requests, potentially leading to disruption of business processes, data loss, and integrity breaches.
Recommendation
Update the plugin to the latest version that includes a fix. Additionally, verify that access to the endpoint is properly authorized and restricted.
Other vulnerabilities in Return Refund and Exchange For WooCommerce
See all- CVE-2026-81799High
The Return Refund and Exchange For WooCommerce plugin in versions up to 4.6.4 contains a Broken Access Control vulnerability. An unauthenticated attacker can bypass access control mechanisms.
- CVE-2026-77695Medium
The Return Refund and Exchange For WooCommerce WordPress plugin before version 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users. This allows them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
Original NVD description (English source)
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wps_rma_cancel_return_request' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS