EUVD-2026-75528
GHSA-w59f-g372-95cg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Unauthenticated network exploitation via HTTP with no complexity; integrity-only impact on order data; no confidentiality or availability impact described.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
4DescriptionCVE.org
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions.
AnalysisAI
Broken access control in the Return Refund and Exchange For WooCommerce WordPress plugin by WP Swings (versions ≤ 4.6.4) exposes privileged refund, return, or exchange management operations to unauthenticated remote attackers. The CVSS vector (PR:N/I:H) confirms that no authentication is required and that the integrity impact is high, consistent with CWE-862 (Missing Authorization) - meaning the plugin registers AJAX hooks or REST API routes without verifying WordPress user capabilities before executing write operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions required beyond the plugin being installed and active on a WordPress + WooCommerce site running version 4.6.4 or earlier. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N establishes that this is remotely and trivially exploitable with no prerequisites, producing a high integrity impact - an attacker can manipulate order-level data. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Return Refund and Exchange For WooCommerce plugin to a version above 4.6.4 immediately. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all sites running Return Refund and Exchange plugin versions ≤4.6.4 and isolate them from production if possible; enable detailed logging on refund and exchange operations to detect suspicious activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be up
Unauthenticated ownership bypass in the Return Refund and Exchange For WooCommerce plugin (versions before 4.6.4) expose
The Return Refund and Exchange For WooCommerce - Return Management System, RMA Exchange, Wallet And Cancel Order Feature
The Return Refund and Exchange For WooCommerce - Return Management System, RMA Exchange, Wallet And Cancel Order Feature
Same weakness CWE-862 – Missing Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today