CVE-2026-77695

6.5 Moyenne

Publiée le 26/08/2026 à 08:16 · Modifiée le 26/08/2026 à 18:30 · Analyse NVD reportée · Source : contact@wpscan.com

Description

The Return Refund and Exchange For WooCommerce WordPress plugin before 4.6.4 does not correctly verify the ownership of guest orders in some of the AJAX actions it exposes to unauthenticated users, allowing them to read private order messages, post messages and attachments in the customer's name, and cancel return requests on any guest order.

Traduire en français

Produits concernés

Unknown Return Refund and Exchange For WooCommerce

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N`

Faiblesses (CWE)

CWE-284

Références

https://wpscan.com/vulnerability/2b09bafa-d812-4247-8199-ce7f2dbac85e/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories