4.3
Medium
CVE-2025-12086 The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in…
Description
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wps_rma_cancel_return_request' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Return Refund and Exchange For WooCommerce 4.5 | earliest → 4.5.5 | No fix stated |
Other CVEs of Return Refund and Exchange For WooCommerce
The 4 CVEs of Return Refund and Exchange For WooCommerce →
CVE-2025-12881
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in…
5.4
Medium
CVE-2024-13692
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order…
5.4
Medium
CVE-2024-13641
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order…
5.9
Medium