Insecure Direct Object Reference Vulnerability in WooCommerce Refund Management Plugin
CVE-2024-13692
5.4MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 14 February 2025
What is CVE-2024-13692?
The Return Refund and Exchange For WooCommerce plugin for WordPress is exposed to Insecure Direct Object Reference vulnerabilities due to insufficient validation of user-controlled keys. Attackers exploiting this vulnerability can potentially overwrite refund image attachments, modify refund request messages, alter order messages, and gain unauthorized access to read order messages belonging to other users across all plugin versions up to and including 4.4.5.
Affected Version(s)
Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features * <= 4.4.5