Y2
Public vulnerability disclosure

CVE-2026-81799

WordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability

publishedCWE-862

Missing Authorization vulnerability in WP Swings Return Refund and Exchange For WooCommerce woo-refund-and-exchange-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Return Refund and Exchange For WooCommerce: from n/a through 4.6.4.

Investigate in Cyber JSONMarkdown
Technical severity7.5 highCVSS 3.1 · CNA: Patchstack
Published2026-09-10Source updated 2026-11-02
Collected2026-11-022 attributed sources

Fixes and workarounds

Fix

Update the WordPress Return Refund and Exchange For WooCommerce plugin to the latest available version (at least 4.6.5).

Source: CNA: Patchstack

Affected products and versions

ProductVersionsAuthority
Return Refund and Exchange For WooCommerce
WP Swings
woo-refund-and-exchange-lite
https://wordpress.org/plugins 		≥ 0; ≤ 4.6.4 (affected, custom); unaffected at 4.6.5
Other versions: unaffected 		CNA: Patchstack

Version ranges are source assertions. Check the vendor advisory and your installed configuration before determining exposure.

CVSS assessments

Version / scoreVectorAuthority
3.1 / 7.5
high		 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NCNA: Patchstack

Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

References