The vulnerability is a Missing Authorization flaw in WP Swings Return Refund and Exchange For WooCommerce, allowing an attacker to bypass the plugin’s access control and exploit incorrectly configured security levels in refund and exchange functions. This flaw enables unauthorized manipulation of refund or exchange requests without authentication, potentially altering financial data or exposing sensitive customer information. The weakness is a classic Broken Access Control scenario (CWE‑862).

WordPress sites running WP Swings: Return Refund and Exchange For WooCommerce plugin version 4.6.4 or earlier are impacted. No other versions are affected.

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is 0.00346 (<1%), and the vulnerability is not listed in the CISA KeV catalog, suggesting limited known exploitation but still a significant risk. The attack vector is inferred to be via the web application layer, as the control check is bypassed without any authentication requirement. Exploitation would require only a crafted request to the plugin’s refund endpoints.