CVE-2025-12881: 
WordPress vulnerability analysis and mitigation

CVE-2025-12881 is an Insecure Direct Object Reference (IDOR) vulnerability in the Return Refund and Exchange For WooCommerce plugin for WordPress, affecting all versions up to and including 4.5.5. The flaw exists in the wps_rma_fetch_order_msgs() function, which fails to validate a user-controlled key, allowing authenticated attackers with Subscriber-level access or higher to read other users' order messages. It was published on November 21, 2025, and assigned a CVSS v3.1 base score of 5.4 (Medium) by Wordfence (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The wps_rma_fetch_order_msgs() function accepts a user-supplied order identifier without verifying that the requesting user is the legitimate owner of that order, enabling horizontal privilege escalation. An attacker with a valid WordPress account (Subscriber role or above) can supply arbitrary order IDs in requests to retrieve order messages belonging to other customers. The patch is visible in the plugin's SVN changeset, which introduces proper ownership validation (WordPress Plugin Changeset, Wordfence).

Successful exploitation allows an authenticated attacker to read order messages of any other customer on the WooCommerce store, potentially exposing sensitive order details, customer communications, and personally identifiable information (PII). The integrity impact noted in the CVSS score (C:L/I:L) suggests there may also be a limited ability to manipulate data through the same unvalidated reference. Availability is not impacted, but the confidentiality breach could facilitate fraud, social engineering, or regulatory compliance violations (e.g., GDPR) for affected store operators (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires a valid authenticated session (Subscriber level or above), which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence).

1. Obtain a low-privilege account: Register or obtain a Subscriber-level (or higher) WordPress account on the target WooCommerce store running the vulnerable plugin (version ≤ 4.5.5).
2. Authenticate: Log in to the WordPress site to obtain a valid session cookie or nonce.
3. Identify the vulnerable endpoint: Locate the AJAX action or REST endpoint that invokes wps_rma_fetch_order_msgs(), typically triggered via WordPress's admin-ajax.php with a specific action parameter.
4. Enumerate order IDs: Craft requests supplying sequential or guessed order IDs (e.g., order_id=1001, order_id=1002) in the user-controlled key parameter, without any ownership check being enforced by the plugin.
5. Retrieve victim order messages: The server returns order messages for the specified order ID regardless of ownership, exposing customer communications and order details to the attacker (Wordfence, WordPress Plugin Changeset).

• Network: Repeated AJAX requests to wp-admin/admin-ajax.php with the action parameter corresponding to wps_rma_fetch_order_msgs and sequentially incrementing or varied order_id values from a single authenticated session.
• Logs: WordPress or web server access logs showing a single user account making high-frequency requests to the order message fetch endpoint with different order IDs in a short time window.
• Application: Unusual access patterns in WooCommerce order logs where a non-owner account's session is associated with order message retrieval events across multiple unrelated orders.

Store administrators should update the Return Refund and Exchange For WooCommerce plugin to version 4.5.6 or later, which introduces proper ownership validation in the wps_rma_fetch_order_msgs() function. No configuration-based workaround is available; upgrading is the only effective remediation. As an interim measure, administrators may consider restricting new user registrations or auditing existing Subscriber-level accounts if immediate patching is not possible (Wordfence, WordPress Plugin Changeset).