Description

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-26T06:16:29.410Z",
  "pubdate": "2026-08-26T06:16:29.410Z",
  "executiveSummary": "The Return Refund and Exchange For WooCommerce plugin, in versions prior to 4.6.4, contains a critical security vulnerability categorized as an Insecure Direct Object Reference (IDOR) or Broken Access Control issue.\nThis vulnerability exists within specific AJAX actions exposed to unauthenticated users that fail to perform adequate authorization checks to verify ownership of guest orders.\nBy manipulating request parameters associated with order identifiers, unauthenticated remote attackers can bypass security controls to interact with sensitive order data.\nThe impact is significant, allowing unauthorized actors to perform actions such as reading private correspondence, injecting malicious messages or attachments into customer threads, and unilaterally cancelling return requests.\nThis flaw compromises the confidentiality, integrity, and availability of the customer order management workflow, potentially leading to unauthorized data exposure and disruption of legitimate refund processing.\nExploitation requires no special authentication, as the vulnerable endpoints are reachable by any remote user, making this a high-risk security flaw for WordPress instances utilizing the affected plugin version.",
  "technicalDetails": "The vulnerability resides within the plugin's AJAX handler architecture, which processes requests related to order management and return request handling. The root cause is the absence of sufficient server-side validation or nonce verification to ensure that the requester possesses the appropriate authority or ownership over the specified order ID.\nIn the affected versions prior to 4.6.4, the plugin exposes multiple AJAX actions intended for guest order functionality. These handlers perform operations such as fetching order details, inserting communication logs, or modifying the status of return requests based on user-provided order references.\nBecause the plugin logic trusts the user-supplied identifiers without secondary verification (e.g., verifying an order token, email address, or session correlation), it creates an IDOR vulnerability. An attacker can enumerate or guess valid order IDs to gain unauthorized access to any guest order registered in the WooCommerce system.\nThe attack flow proceeds as follows: First, the attacker identifies the specific AJAX action endpoints responsible for guest order operations. Second, the attacker crafts a malicious request targeting these endpoints, substituting their own order ID with a target ID. Third, the backend server processes the request as a legitimate user action because the check for order ownership or session verification is bypassed or missing. Finally, the server executes the requested operation—such as retrieving message logs containing private customer data, appending unauthorized text or attachments to the order history, or issuing a command to cancel a return request.\nThe post-exploitation impact includes the potential for sensitive information disclosure (e.g., customer communication or order details), data tampering (adding unauthorized attachments or messages), and malicious service disruption by interrupting the return and refund process. This vulnerability is particularly dangerous as it allows for unauthorized interaction with orders without requiring any prior user account or authentication session."
}