Return Refund and Exchange For WooCommerce CVE-2026-81799

No special conditions required beyond the plugin being installed and active on a WordPress + WooCommerce site running version 4.6.4 or earlier. The CVSS vector PR:N/AC:L/UI:N confirms unauthenticated remote exploitation against any default installation of the affected plugin. Limiting factors include: the target site must have the plugin active (not just installed), and the attacker must know or enumerate the specific WordPress AJAX action name or REST route exposed by the vulnerable code path - neither of which constitutes a meaningful barrier given the plugin's public source code. No specific non-default configuration is required to be vulnerable.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N establishes that this is remotely and trivially exploitable with no prerequisites, producing a high integrity impact - an attacker can manipulate order-level data. EPSS data is absent from the provided input, and this CVE is not listed in CISA KEV, indicating no confirmed active exploitation. Patchstack is a credible WordPress-specific security reporter with a strong track record on this class of vulnerability. The practical risk is real for WooCommerce merchants: fraudulent refund requests, cancellation of legitimate exchange orders, or order-status manipulation could cause financial loss. The absence of confidentiality impact (C:N) suggests sensitive data exposure is not part of this attack path, keeping scope contained to data integrity. Real-world risk is moderate-to-high for affected e-commerce operators rather than internet-wide, as targeting requires knowledge of affected shop endpoints.

An unauthenticated attacker sends a crafted HTTP POST request to the WordPress AJAX endpoint or a WooCommerce REST API route registered by the plugin, triggering an order-manipulation action - such as creating a fraudulent refund request or cancelling a legitimate exchange - without providing any credentials or nonce. Because the plugin performs no authorization check, the server processes the request as if it came from an authorized user. No exploit code has been publicly released, but the attack is straightforward given the low complexity and standard nature of WordPress AJAX abuse.