CVE-2025-12881
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
Risk Assessment
The risk includes unauthorized access to sensitive order information, which could compromise customer privacy and data confidentiality. This may lead to loss of trust and legal consequences.
Recommendation
It is recommended to immediately update the plugin to the latest version that includes the fix. Also, restrict user privileges to the minimum necessary.
Other vulnerabilities in Return Refund and Exchange For WooCommerce
See all- CVE-2026-81799High
The Return Refund and Exchange For WooCommerce plugin in versions up to 4.6.4 contains a Broken Access Control vulnerability. An unauthenticated attacker can bypass access control mechanisms.
- CVE-2026-77695Medium
The Return Refund and Exchange For WooCommerce WordPress plugin before version 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users. This allows them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
- CVE-2025-12086Medium
The Return Refund and Exchange For WooCommerce plugin for WordPress up to version 4.5.5 is vulnerable to Insecure Direct Object Reference in the AJAX endpoint 'wps_rma_cancel_return_request' due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to delete other users' refund requests.
Original NVD description (English source)
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS