5.4
Moyenne
CVE-2025-12881 The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in…
Description
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Return Refund and Exchange For WooCommerce 4.5 | premières → 4.5.5 | Pas de correctif indiqué |
Autres CVE de Return Refund and Exchange For WooCommerce
Les 4 CVE de Return Refund and Exchange For WooCommerce →
CVE-2025-12086
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in…
4.3
Moyenne
CVE-2024-13692
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order…
5.4
Moyenne
CVE-2024-13641
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order…
5.9
Moyenne