Unauthorized Order Access in Return Refund and Exchange Plugin for WooCommerce
CVE-2026-77695
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 August 2026
Badges
What is CVE-2026-77695?
The Return Refund and Exchange For WooCommerce plugin for WordPress prior to version 4.6.4 contains a vulnerability that fails to properly verify guest order ownership during certain AJAX operations. This oversight permits unauthenticated users to gain access to private order communications, enable unauthorized messaging or attachments in the name of the customer, and even cancel return requests for guest orders. This could lead to significant security implications for customer data privacy and order integrity.
Affected Version(s)
Return Refund and Exchange For WooCommerce 4.4.6 < 4.6.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.