Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-10
Return Refund and Exchange For WooCommerce - Broken Access Control (CVE-2026-81799)
Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce
PLUGIN
Return Refund and Exchange For WooCommerce
CVE-2026-81799
Risk Score
Threat Entry
Updated 2026-08-26
Return Refund and Exchange For WooCommerce - Security Vulnerability (CVE-2026-77695)
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
PLUGIN
Return Refund and Exchange For WooCommerce
CVE-2026-77695
Risk Score
Threat Entry
Updated 2026-06-17
Return Refund And Exchange For Woocommerce - Security Vulnerability (CVE-2025-12881)
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
PLUGIN
Return Refund And Exchange For Woocommerce
CVE-2025-12881
Risk Score
Threat Entry
Updated 2026-06-17
Return Refund And Exchange For Woocommerce - Security Vulnerability (CVE-2025-12086)
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wps_rma_cancel_return_request' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests.
PLUGIN
Return Refund And Exchange For Woocommerce
CVE-2025-12086
Risk Score
Threat Entry
Updated 2026-06-17
Return Refund and Exchange For WooCommerce - Security Vulnerability (CVE-2024-13692)
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite linked refund image attachments, overwrite refund request message, overwrite order messages, and read order messages of other users.
PLUGIN
Return Refund and Exchange For WooCommerce
CVE-2024-13692
Risk Score
Threat Entry
Updated 2026-06-17
Return Refund and Exchange For WooCommerce - Information Disclosure (CVE-2024-13641)
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
PLUGIN
Return Refund and Exchange For WooCommerce
CVE-2024-13641
Risk Score
Threat Entry
Updated 2026-06-17
Return Refund and Exchange For WooCommerce - Remote Code Execution (CVE-2022-4047)
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
PLUGIN
Return Refund and Exchange For WooCommerce
CVE-2022-4047
Risk Score