The Return Refund and Exchange For WooCommerce plugin contains an insecure direct object reference that allows authenticated users with Subscriber-level access or higher to read order messages belonging to other users. The flaw arises due to missing validation on a key passed to the wps_rma_fetch_order_msgs() function, enabling a confidentiality breach by exposing sensitive messages tied to customer orders. This can lead to an attacker learning personal or financial details associated with the orders without needing to compromise the system at a higher privilege level.

The vulnerability impacts the WordPress plugin "Return Refund and Exchange For WooCommerce" developed by wpswings, affecting all released versions up to and including 4.5.5. The affected code path allows any authenticated Subscriber or higher role to exploit the insecure direct object reference.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of < 1% suggests a low likelihood of exploitation in the near term. The vulnerability is not listed in CISA KEV, implying it has not been widely observed in the wild. Attackers would need to be authenticated on the target site, and the exploit path is local/internal, yet the potential for data leakage remains significant for businesses handling customer order information.