CVE-2025-10570
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers with subscriber-level access and above to submit refund requests for arbitrary orders that they do not own.
Risk Assessment
The risk is the possibility of submitting fraudulent refund requests, potentially leading to financial losses and disruption of business processes.
Recommendation
Update the Flexible Refund and Return Order for WooCommerce plugin to a version that includes a fix for the missing authorization.
Other vulnerabilities in Flexible Refund and Return Order for WooCommerce
See all- CVE-2026-57402Medium
The Flexible Refund and Return Order for WooCommerce plugin up to version 1.0.51 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.
- CVE-2025-12621Medium
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.
Original NVD description (English source)
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS