CVE-2026-81799
HighCVSS 7.5Summary
The Return Refund and Exchange For WooCommerce plugin in versions up to 4.6.4 contains a Broken Access Control vulnerability. An unauthenticated attacker can bypass access control mechanisms.
Risk Assessment
An unauthenticated attacker may gain access to functions or data they should not access, potentially leading to unauthorized operations.
Recommendation
Update the Return Refund and Exchange For WooCommerce plugin to a version newer than 4.6.4 or disable it if no update is available.
Other vulnerabilities in Return Refund and Exchange For WooCommerce
See all- CVE-2026-77695Medium
The Return Refund and Exchange For WooCommerce WordPress plugin before version 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users. This allows them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
- CVE-2025-12086Medium
The Return Refund and Exchange For WooCommerce plugin for WordPress up to version 4.5.5 is vulnerable to Insecure Direct Object Reference in the AJAX endpoint 'wps_rma_cancel_return_request' due to missing validation on a user controlled key. This makes it possible for authenticated attackers with Subscriber-level access and above to delete other users' refund requests.
Original NVD description (English source)
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS