Return Refund and Exchange For WooCommerce <= 4.6.4 - Authenticated (Subscriber+) Missing Authorization to Shop Manager Impersonation via 'order_msg_type' Parameter
- ID
- WPSEC-2026-1597
- Plugin
- Return Refund and Exchange For WooCommerce (woo-refund-and-exchange-lite)
- Affected
- all versions before 4.6.5
- Remediation
- Update to 4.6.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-807
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-25
- Attack surface
- Return Refund and Exchange For WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to sender impersonation via the 'order_msg_type' parameter of the wps_rma_send_order_msg AJAX action in all versions up to, and including, 4.6.4. This is due to the sender of an order message being taken from the client-supplied 'order_msg_type' value instead of the current user's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to post messages labelled as coming from the Shop Manager on orders they own, and to have the store send those messages as order message emails to the order's billing email address.
References
- https://wpsec.com/vuln/WPSEC-2026-1597/
- https://plugins.svn.wordpress.org/woo-refund-and-exchange-lite/tags/4.6.5/
- https://wordpress.org/plugins/woo-refund-and-exchange-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS