Return Refund and Exchange For WooCommerce <= 4.6.4 - Missing Authorization to Unauthenticated Plugin Settings Update
- ID
- WPSEC-2026-1596
- Plugin
- Return Refund and Exchange For WooCommerce (woo-refund-and-exchange-lite)
- Affected
- all versions before 4.6.5
- Remediation
- Update to 4.6.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Return Refund and Exchange For WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the wps_standard_save_settings_filter AJAX action in all versions up to, and including, 4.6.4. This is due to a missing capability check in the wps_rma_standard_save_settings_filter() function. The action is registered for unauthenticated users, and its only protection is an 'ajax-nonce' nonce that is printed to every visitor of the public 'View Order Messages' page. This makes it possible for unauthenticated attackers to change plugin settings, such as turning on the refund, exchange, cancellation, wallet and order message features, and turning on usage tracking.
References
- https://wpsec.com/vuln/WPSEC-2026-1596/
- https://plugins.svn.wordpress.org/woo-refund-and-exchange-lite/tags/4.6.5/
- https://wordpress.org/plugins/woo-refund-and-exchange-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS