Return Refund and Exchange for WooCommerce Insecure Direct Object Reference Vulnerability

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Return Refund and Exchange for WooCommerce plugin for WordPress, affecting all versions through 4.5.5. The vulnerability arises in the 'wps_rma_cancel_return_request' AJAX endpoint, where insufficient validation on a user-controlled key allows authenticated attackers with Subscriber-level access and above to delete refund requests belonging to other users.

Impact

Exploitation of this vulnerability allows for unauthorized cancellation of refund requests, potentially leading to financial loss or disruption of service for affected users.

Remediation

Users can update to version 4.5.6 or a newer patched version to address this vulnerability.