CVE-2025-12621
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.
Risk Assessment
An attacker with low privileges could approve or refuse refunds, potentially leading to financial losses and abuse in the refund process.
Recommendation
Update the Flexible Refund and Return Order for WooCommerce plugin to a version newer than 1.0.42 or fix the capability check in the 'create_refund' function.
Other vulnerabilities in Flexible Refund and Return Order for WooCommerce
See all- CVE-2026-57402Medium
The Flexible Refund and Return Order for WooCommerce plugin up to version 1.0.51 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.
- CVE-2025-10570Medium
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers with subscriber-level access and above to submit refund requests for arbitrary orders that they do not own.
Original NVD description (English source)
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS