Insecure Direct Object Reference Vulnerability in WooCommerce Refund Management Plugin
CVE-2024-13692
5.4MEDIUM
Key Information:
- Vendor
- WordPress
- Vendor
- CVE Published:
- 14 February 2025
Summary
The Return Refund and Exchange For WooCommerce plugin for WordPress is exposed to Insecure Direct Object Reference vulnerabilities due to insufficient validation of user-controlled keys. Attackers exploiting this vulnerability can potentially overwrite refund image attachments, modify refund request messages, alter order messages, and gain unauthorized access to read order messages belonging to other users across all plugin versions up to and including 4.4.5.
Affected Version(s)
Return Refund and Exchange For WooCommerce – Return Management System, RMA Exchange, Wallet And Cancel Order Features * <= 4.4.5
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Tim Coen