Vulnerability in Return Refund And Exchange For Woocommerce
CVE-2026-77695
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.
EPSS: 0.002 (6.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
Affected products
- Unknown Return Refund And Exchange For Woocommerce
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-77695?
- CVE-2026-77695 is a medium-severity vulnerability in Return Refund And Exchange For Woocommerce, classified under Improper Access Control. CVSS score: 6.5/10. Published 2026-08-26.
- How severe is CVE-2026-77695?
- Medium severity. CVSS v3 base score is 6.5 out of 10.