CVE-2026-77695 - Vulnerability Details - OpenCVE

Description

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.

Published: 2026-08-26

Score: n/a

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability arises because the Return Refund and Exchange For WooCommerce plugin does not verify the ownership of guest orders in certain AJAX actions. This flaw allows unauthenticated users to read private order messages, post new messages and attachments as if they were the customer, and cancel return requests on any guest order.

Affected Systems

Any WordPress site running the Return Refund and Exchange For WooCommerce plugin with a version earlier than 4.6.4 is vulnerable. This includes all installations that have the plugin installed and have not applied the 4.6.4 update or later.

Risk and Exploitability

The flaw can be exploited by an attacker without authentication simply by sending crafted AJAX requests. No CVSS score is provided, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog, but because the attack is trivial and the impact is significant, the risk is high.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Unknown

Return Refund and Exchange For WooCommerce

unaffected

Version	Status	Constraints
`4.4.6`	affected	< 4.6.4

No data.

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Return Refund and Exchange For WooCommerce plugin to version 4.6.4 or later.
If an immediate update is not possible, deactivate the plugin or block the vulnerable AJAX endpoints to prevent unauthenticated access.
Configure web‑application firewall rules to restrict unauthenticated requests to the plugin’s AJAX URLs.

Generated by OpenCVE AI on August 26, 2026 at 07:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00166.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://wpscan.com/vulnerability/2b09bafa-d812-4247-8199-ce7f2dbac85e/

History

Wed, 26 Aug 2026 07:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-284 CWE-285

Wed, 26 Aug 2026 06:15:00 +0000

Type	Values Removed	Values Added
Description		The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
Title		Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation
References		https://wpscan.com/vulnerability/2b09bafa-d812-4247-8199-ce7f2dbac85e/

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: WPScan

Published: 2026-08-26T06:00:21.617Z

Updated: 2026-08-26T14:43:07.838Z

Reserved: 2026-08-21T07:47:28.952Z

Link: CVE-2026-77695

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-26T07:30:16Z

Weaknesses

CWE-284
Improper Access Control
CWE-285
Improper Authorization

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77695", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-08-21T07:47:28.952Z", "datePublished": "2026-08-26T06:00:21.617Z", "dateUpdated": "2026-08-26T14:43:07.838Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-08-26T06:00:21.617Z"}, "title": "Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation", "problemTypes": [{"descriptions": [{"description": "CWE-284 Improper Access Control", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Return Refund and Exchange For WooCommerce", "versions": [{"status": "affected", "versionType": "semver", "version": "4.4.6", "lessThan": "4.6.4"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order."}], "references": [{"url": "https://wpscan.com/vulnerability/2b09bafa-d812-4247-8199-ce7f2dbac85e/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Shikhali Jamalzade", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-77695", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-26T14:31:19.151412Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-284", "description": "CWE-284 Improper Access Control"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T14:43:07.838Z"}}]}}