EUVD-2026-66285
GHSA-72f4-h9h6-qgpx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Network-accessible AJAX endpoint requires no authentication or interaction; impacts limited to partial confidentiality and integrity on guest order data only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
AnalysisAI
Unauthenticated ownership bypass in the Return Refund and Exchange For WooCommerce plugin (versions before 4.6.4) exposes guest order workflows to arbitrary third-party manipulation. Any unauthenticated network attacker who can reference a guest order ID can read private order messages, impersonate the customer by posting messages or attachments, and cancel active return requests - undermining both customer privacy and merchant return-process integrity. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WooCommerce site has the Return Refund and Exchange For WooCommerce plugin installed and active in a version prior to 4.6.4, and that at least one guest order exists (i.e., guest checkout is enabled and has been used). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) correctly reflects that exploitation is trivially accessible over the network with no authentication, no user interaction, and low attack complexity - a meaningful exposure for any publicly reachable WooCommerce store running the plugin. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker enumerates or brute-forces sequential WooCommerce guest order IDs (which are often predictable integers), then crafts unauthenticated AJAX POST requests targeting the plugin's RMA action handlers, supplying the order ID without a valid ownership token. Because the plugin fails to verify ownership, the attacker can extract private order correspondence, inject fraudulent messages appearing to come from the customer, or cancel pending return requests - disrupting legitimate refund workflows or harvesting order details. … |
| Remediation | The vendor-released patch is version 4.6.4 of the Return Refund and Exchange For WooCommerce plugin; site operators should update immediately via the WordPress admin dashboard or WP-CLI. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be up
The Return Refund and Exchange For WooCommerce - Return Management System, RMA Exchange, Wallet And Cancel Order Feature
The Return Refund and Exchange For WooCommerce - Return Management System, RMA Exchange, Wallet And Cancel Order Feature
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today