The Return Refund and Exchange For WooCommerce plugin for WordPress suffers from an information exposure vulnerability (CWE-200) in all versions up to 4.4.5. Specifically, sensitive files stored in the /wp-content/attachment directory are accessible without authentication, enabling unauthorized actors to retrieve potentially sensitive data related to order refunds. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high confidentiality impact with no impact on integrity or availability.

Unauthorized actors can access sensitive information stored in the plugin's attachment directory, potentially exposing confidential data related to order refunds. This compromises the confidentiality of customer or business information but does not affect data integrity or system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently referenced, users should monitor the vendor's communications for updates. Until a fix is available, restricting access to the /wp-content/attachment directory via web server configuration or other access controls may help mitigate exposure.