CVE-2026-77695 — Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation

CVE-2026-77695

Woo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and Manipulation PUBLISHED

Description (CNA)

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.

Affected (CNA)

Vendor / product	Versions
Unknown / Return Refund and Exchange For WooCommerce	affected 4.4.6 before 4.6.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/2b09bafa-d812-4247-8199-ce7f2dbac85e/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.