# Return Refund and Exchange For WooCommerce <= 4.6.4 - Missing Authorization to Unauthenticated Plugin Settings Update

- **ID:** WPSEC-2026-1596
- **Plugin:** Return Refund and Exchange For WooCommerce (`woo-refund-and-exchange-lite`), https://wordpress.org/plugins/woo-refund-and-exchange-lite/
- **Affected versions:** all versions before 4.6.5
- **Fixed in:** 4.6.5 (Update to 4.6.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-refund-and-exchange-lite
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1596/

## Description

The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via the wps_standard_save_settings_filter AJAX action in all versions up to, and including, 4.6.4. This is due to a missing capability check in the wps_rma_standard_save_settings_filter() function. The action is registered for unauthenticated users, and its only protection is an 'ajax-nonce' nonce that is printed to every visitor of the public 'View Order Messages' page. This makes it possible for unauthenticated attackers to change plugin settings, such as turning on the refund, exchange, cancellation, wallet and order message features, and turning on usage tracking.

## References

- https://wpsec.com/vuln/WPSEC-2026-1596/
- https://plugins.svn.wordpress.org/woo-refund-and-exchange-lite/tags/4.6.5/
- https://wordpress.org/plugins/woo-refund-and-exchange-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1596/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.