Return Refund And Exchange For Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:wpswings:return_refund_and_exchange_for_woocommerce:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Wpswings (325d4910-7fb8-5524-97f5-2fb5d0fe400a) |
|---|---|
| Product | Return Refund And Exchange For Woocommerce (e086817d-bc87-5e43-9973-c58e2d6aab0a) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/wpswings/woo-refund-and-exchange-lite |
purl2cpe | 2026-06-01 10:16:33.701217 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-12881 |
vulnerable | 2026-06-03 14:58:45.133398 |
Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Order Message Read
MEDIUM (5.4)
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the wps_rma_fetch_order_msgs() due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read other user's order messages.
Published: 2025-11-21T07:31:53.213Z
Updated: 2026-04-08T17:11:23.231Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-12086 |
vulnerable | 2026-06-03 14:58:43.772756 |
Return Refund and Exchange For WooCommerce <= 4.5.5 - Insecure Direct Object Reference to Authenticated (Subscriber+) Refund Request Cancellation
MEDIUM (4.3)
The Return Refund and Exchange For WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.5.5 via the 'wps_rma_cancel_return_request' AJAX endpoint due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete other users refund requests.
Published: 2025-11-21T07:31:47.110Z
Updated: 2026-04-08T16:36:25.470Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13692 |
vulnerable | 2026-06-03 14:54:25.268295 |
Return Refund and Exchange For WooCommerce <= 4.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference
MEDIUM (5.4)
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.4.5 via several functions due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to overwrite linked refund image attachments, overwrite refund request message, overwrite order messages, and read order messages of other users.
Published: 2025-02-14T05:22:44.354Z
Updated: 2026-04-08T17:27:26.757Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-13641 |
vulnerable | 2026-06-03 14:54:25.142761 |
Return Refund and Exchange For WooCommerce <= 4.4.5 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
MEDIUM (5.9)
The Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.5 via the 'attachment' directory. This makes it possible for unauthenticated attackers to extract sensitive data stored insecurely in the /wp-content/attachment directory which can contain file attachments for order refunds.
Published: 2025-02-14T05:22:43.741Z
Updated: 2026-04-08T16:56:24.154Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.