The Return Refund and Exchange For WooCommerce plugin contains an insecure direct object reference in the wps_rma_cancel_return_request AJAX endpoint. Because the plugin does not validate the user‑controlled key, any authenticated user with Subscriber or higher privileges can send a request that will delete another user’s refund record. This leads to unauthorized cancellation of refund requests, potentially causing financial loss or customer dissatisfaction. The weakness is classified as CWE‑639.

The vulnerability affects the Return Refund and Exchange For WooCommerce plugin by wpswings. Versions up to and including 4.5.5 are susceptible. Any WordPress site that has installed these versions of the plugin is at risk.

The CVSS score of 4.3 indicates a moderate severity. The EPSS score of less than 1% suggests the likelihood of exploitation is very low at present, and the issue is not listed in the CISA KEV catalog. Exploitation requires authentication with at least a Subscriber role and involves sending a crafted AJAX request to the wps_rma_cancel_return_request endpoint. The absence of validation on the request key directly enables the attacker to target other users’ refund records.