5.4
Medium
CVE-2025-12881 The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in…
Description
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Return Refund and Exchange For WooCommerce 4.5 | earliest → 4.5.5 | No fix stated |
Other CVEs of Return Refund and Exchange For WooCommerce
The 4 CVEs of Return Refund and Exchange For WooCommerce →
CVE-2025-12086
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in…
4.3
Medium
CVE-2024-13692
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order…
5.4
Medium
CVE-2024-13641
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order…
5.9
Medium