# Return Refund and Exchange For WooCommerce <= 4.6.4 - Authenticated (Subscriber+) Missing Authorization to Shop Manager Impersonation via 'order_msg_type' Parameter

- **ID:** WPSEC-2026-1597
- **Plugin:** Return Refund and Exchange For WooCommerce (`woo-refund-and-exchange-lite`), https://wordpress.org/plugins/woo-refund-and-exchange-lite/
- **Affected versions:** all versions before 4.6.5
- **Fixed in:** 4.6.5 (Update to 4.6.5 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-807
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-25)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-refund-and-exchange-lite
- **Fix released:** 2026-10-23
- **Published:** 2026-10-24
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1597/

## Description

The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to sender impersonation via the 'order_msg_type' parameter of the wps_rma_send_order_msg AJAX action in all versions up to, and including, 4.6.4. This is due to the sender of an order message being taken from the client-supplied 'order_msg_type' value instead of the current user's role. This makes it possible for authenticated attackers, with Subscriber-level access and above, to post messages labelled as coming from the Shop Manager on orders they own, and to have the store send those messages as order message emails to the order's billing email address.

## References

- https://wpsec.com/vuln/WPSEC-2026-1597/
- https://plugins.svn.wordpress.org/woo-refund-and-exchange-lite/tags/4.6.5/
- https://wordpress.org/plugins/woo-refund-and-exchange-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1597/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.