The Return Refund and Exchange For WooCommerce plugin suffers from an improper authorization vulnerability (CWE-285) caused by missing validation on a user-controlled key. This insecure direct object reference flaw allows unauthenticated attackers to overwrite linked refund image attachments, refund request messages, and order messages, as well as read order messages belonging to other users. The vulnerability affects all versions up to 4.4.5 and has a CVSS 3.1 base score of 5.4, indicating medium severity. There is no indication of known exploits in the wild or available patches.

An attacker without authentication can manipulate refund and order-related data of other users by exploiting missing authorization checks. This can lead to unauthorized disclosure of order messages and unauthorized modification of refund images and messages. The impact is limited to confidentiality and integrity of order and refund data, with no reported availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict access to the plugin's functionality to trusted users and consider disabling or limiting the affected features if possible.