Insecure Direct Object Reference Vulnerability in WooCommerce Refund Management Plugin

CVE-2024-13692

What is CVE-2024-13692?

The Return Refund and Exchange For WooCommerce plugin for WordPress is exposed to Insecure Direct Object Reference vulnerabilities due to insufficient validation of user-controlled keys. Attackers exploiting this vulnerability can potentially overwrite refund image attachments, modify refund request messages, alter order messages, and gain unauthorized access to read order messages belonging to other users across all plugin versions up to and including 4.4.5.

References