CVE-2026-77695: WooCommerce Return Plugin Auth Bypass Flaw

CVE-2026-77695 Overview

CVE-2026-77695 is a broken access control vulnerability in the Return Refund and Exchange for WooCommerce WordPress plugin before version 4.6.4. The plugin fails to verify guest order ownership in several AJAX actions exposed to unauthenticated users. Attackers can read private order messages, post messages and attachments impersonating the customer, and cancel return requests on any guest order. The flaw is tracked under CWE-284: Improper Access Control and requires no authentication or user interaction.

Critical Impact
Unauthenticated attackers can enumerate guest orders, exfiltrate private order communications, impersonate customers in return threads, and cancel legitimate return requests on any guest order.

Affected Products

Return Refund and Exchange for WooCommerce WordPress plugin versions prior to 4.6.4
WordPress sites running WooCommerce with the affected plugin enabled
Storefronts that permit guest checkout with return workflows

Discovery Timeline

2026-08-26 - CVE-2026-77695 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-77695

Vulnerability Analysis

The plugin exposes several AJAX endpoints intended to let guest customers manage return, refund, and exchange requests on their orders. These endpoints accept order identifiers from the client but do not validate that the requester actually owns the referenced guest order. Because guests are not authenticated, the plugin should bind sensitive actions to a per-order secret such as the order key. That check is missing or inadequate, so any unauthenticated user who supplies a valid order identifier can invoke the actions on another customer's behalf.

The attack is entirely network-based against admin-ajax.php and requires no privileges or user interaction. Confidentiality and integrity of order communications are affected; availability of the return workflow is affected only through the cancel action.

Root Cause

The root cause is improper access control [CWE-284] in the plugin's AJAX handlers. Ownership verification for guest orders is either absent or trusts client-supplied parameters. The handlers do not enforce a comparison against the WooCommerce order key or an equivalent unguessable token tied to the order session.

Attack Vector

An unauthenticated attacker sends crafted POST requests to the vulnerable AJAX actions on the target WordPress site. By iterating or guessing guest order identifiers, the attacker can read private return thread messages, post attacker-controlled messages and file attachments that appear to originate from the legitimate customer, or cancel pending return requests. Refer to the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-77695

Indicators of Compromise

Unauthenticated POST requests to wp-admin/admin-ajax.php targeting the plugin's return, refund, or exchange actions from a single source across many order IDs
Unexpected new messages or file attachments appended to guest return threads outside normal customer session activity
Return requests transitioning to a cancelled state without corresponding customer authentication logs
Uploaded attachments in the plugin's message storage originating from IPs unrelated to the customer's checkout session

Detection Strategies

Alert on high-volume enumeration patterns against admin-ajax.php where the action parameter matches the plugin's guest return handlers
Correlate return-thread modifications with the absence of an authenticated wordpress_logged_in cookie or matching customer session
Compare source IP and user-agent of return-thread activity against the IP that originally placed the order

Monitoring Recommendations

Enable verbose WooCommerce and plugin logging for order status changes and return request lifecycle events
Forward web server access logs to a centralized analytics platform and baseline normal AJAX action frequency per client
Monitor filesystem writes to the plugin's attachment directory for uploads not tied to a known customer session

How to Mitigate CVE-2026-77695

Immediate Actions Required

Update the Return Refund and Exchange for WooCommerce plugin to version 4.6.4 or later on all WordPress sites
Audit recent guest return threads for unauthorized messages, attachments, or cancellations since the plugin was installed
Review web server logs for enumeration of guest order identifiers via admin-ajax.php
Rotate any support workflows or refunds that were actioned based on messages posted through the vulnerable endpoints

Patch Information

The vendor addressed CVE-2026-77695 in version 4.6.4 of the Return Refund and Exchange for WooCommerce plugin by enforcing ownership verification on the affected AJAX actions. Administrators should apply the update through the WordPress plugin dashboard or WP-CLI. Details are available in the WPScan Vulnerability Report.

Workarounds

Disable the plugin until the patched version can be installed if guest returns are not business-critical
Restrict access to admin-ajax.php return actions using a web application firewall rule that requires a valid session cookie or referring page
Temporarily disable guest checkout in WooCommerce so return workflows require an authenticated customer account

bash

# Update the plugin via WP-CLI
wp plugin update woo-refund-and-exchange-lite --version=4.6.4
wp plugin list --name=woo-refund-and-exchange-lite --fields=name,status,version