Insecure Direct Object Reference Vulnerability in WooCommerce Refund Management Plugin

CVE-2024-13692

What is CVE-2024-13692?

The Return Refund and Exchange For WooCommerce plugin for WordPress is exposed to Insecure Direct Object Reference vulnerabilities due to insufficient validation of user-controlled keys. Attackers exploiting this vulnerability can potentially overwrite refund image attachments, modify refund request messages, alter order messages, and gain unauthorized access to read order messages belonging to other users across all plugin versions up to and including 4.4.5.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References