vulnerability
WordPress Plugin: flexible-refund-and-return-order-for-woocommerce: CVE-2025-12621: Incorrect Authorization
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 5 | (AV:N/AC:L/Au:N/C:N/I:P/A:N) | Nov 7, 2025 | Nov 10, 2025 | Nov 10, 2025 |
Severity
5
CVSS
(AV:N/AC:L/Au:N/C:N/I:P/A:N)
Published
Nov 7, 2025
Added
Nov 10, 2025
Modified
Nov 10, 2025
Description
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a misconfigured capability check on the 'create_refund' function in all versions up to, and including, 1.0.42. This makes it possible for authenticated attackers, with Contributor-level access and above, to update the status of refund requests, including approving and refusing refunds.
Solution
flexible-refund-and-return-order-for-woocommerce-plugin-cve-2025-12621
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.