CVE-2026-77695: CWE-284 Improper Access Control in Return Refund and Exchange For WooCommerce

CVE-2026-77695 is an improper access control vulnerability (CWE-284) in the Return Refund and Exchange For WooCommerce WordPress plugin before version 4.6.4. The plugin fails to properly verify ownership of guest orders in some AJAX endpoints exposed to unauthenticated users. This allows attackers to read private messages related to guest orders, post messages and attachments impersonating the customer, and cancel return requests on any guest order. The vulnerability has a CVSS 3.1 base score of 6.5 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts confidentiality and integrity but not availability.

An attacker without authentication can access and manipulate guest order data. Specifically, they can read private order messages, post messages and attachments as if they were the customer, and cancel return requests. This compromises the confidentiality and integrity of guest order information and related processes.

No official fix or patch is currently confirmed. Users should monitor the vendor's advisory for updates and apply any official patches once available. Until then, consider restricting access to AJAX endpoints or disabling the plugin if guest order functionality is not required.