WooCommerce RMA Plugin CVE-2026-77695

Exploitation requires that the target WooCommerce site has the Return Refund and Exchange For WooCommerce plugin installed and active in a version prior to 4.6.4, and that at least one guest order exists (i.e., guest checkout is enabled and has been used). The attacker must be able to reference a valid guest order ID - in WooCommerce, order IDs are sequential integers, making enumeration feasible without any credentials. No authentication is required per CVSS PR:N. Exploitation is limited exclusively to guest orders; orders placed by registered, logged-in customers are not confirmed to be affected based on available data. The practical limiting factor is order ID discovery, which requires either enumeration or prior knowledge of a specific order.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) correctly reflects that exploitation is trivially accessible over the network with no authentication, no user interaction, and low attack complexity - a meaningful exposure for any publicly reachable WooCommerce store running the plugin. However, real-world priority should be moderated by several signals: EPSS at 0.17% (6th percentile) indicates that mass automated exploitation is not occurring and adversary tooling for this specific flaw is not widespread; the vulnerability is not listed in CISA KEV, so confirmed active exploitation is absent. The impact is bounded - both confidentiality and integrity components are rated Low, with no availability impact, and scope is unchanged. Exploitation depends on the attacker knowing or guessing valid guest order IDs, which adds a practical barrier. Nonetheless, a publicly available POC lowers the skill floor, making this a credible opportunistic risk for unpatched sites rather than a high-priority emergency. The 'Microsoft' tag in the intelligence data appears to be an erroneous tagging artifact and should be disregarded.

An attacker enumerates or brute-forces sequential WooCommerce guest order IDs (which are often predictable integers), then crafts unauthenticated AJAX POST requests targeting the plugin's RMA action handlers, supplying the order ID without a valid ownership token. Because the plugin fails to verify ownership, the attacker can extract private order correspondence, inject fraudulent messages appearing to come from the customer, or cancel pending return requests - disrupting legitimate refund workflows or harvesting order details. A publicly available proof-of-concept lowers the skill threshold for this attack.