The Return Refund and Exchange For WooCommerce plugin suffers from an authorization bypass vulnerability (CWE-639) due to missing validation on a user-controlled key in the 'wps_rma_cancel_return_request' AJAX endpoint. This allows attackers with low-level authenticated access (Subscriber or above) to delete refund requests belonging to other users, violating access controls. The vulnerability affects all versions up to 4.5.5. The CVSS 3.1 base score is 4.3, reflecting a medium severity impact with low attack complexity and no user interaction required.

An attacker with Subscriber-level or higher privileges can delete refund requests submitted by other users, potentially disrupting refund processes and causing denial of service for legitimate refund requests. There is no direct confidentiality or availability impact reported. The integrity of refund request data is compromised due to unauthorized deletion.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access where possible and monitor refund request deletions for suspicious activity. Avoid granting unnecessary privileges to low-level users. Follow vendor updates closely for a patch or official mitigation.