CVE-2022-4047critical

CVE-2022-4047: critical vulnerability in Return Refund and Exchange For WooCommerce

Return Refund and Exchange For WooCommerce < 4.0.9 - Unauthenticated Arbitrary File Upload

Published · Updated

Follow this CVE+ Monitor Return Refund and Exchange For WooCommerce

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.8epss 6.6%
from disclosure to weapon274 days
Published on NVDDec 26
1st PoC+274d
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · Return Refund and Exchange For WooCommerce
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Return Refund and Exchange For WooCommerce

In the same product, most dangerous first.

CVE-2026-77695MEDIUMWoo Refund And Exchange Lite < 4.6.4 - Unauthenticated Guest Order Message Disclosure and ManipulationEPSS 0.3%