4.3
Moyenne
CVE-2025-12086 The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in…
Description
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wps_rma_cancel_return_request' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Return Refund and Exchange For WooCommerce 4.5 | premières → 4.5.5 | Pas de correctif indiqué |
Autres CVE de Return Refund and Exchange For WooCommerce
Les 4 CVE de Return Refund and Exchange For WooCommerce →
CVE-2025-12881
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in…
5.4
Moyenne
CVE-2024-13692
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order…
5.4
Moyenne
CVE-2024-13641
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order…
5.9
Moyenne