Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) in the Return Refund and Exchange For WooCommerce plugin for WordPress, affecting all versions up to 4.5.5. It occurs because the 'wps_rma_cancel_return_request' AJAX endpoint does not properly validate a user-controlled key, allowing authenticated users with Subscriber-level access or higher to delete refund requests belonging to other users.

Useful 0 Not Useful 0

Impact Analysis

An attacker with at least Subscriber-level access can exploit this vulnerability to delete refund requests submitted by other users. This could disrupt refund processes, cause loss of important refund data, and potentially lead to customer dissatisfaction or financial discrepancies.

Useful 0 Not Useful 0