PT-2025-43022 · Wpdesk · Flexible Refund/Return Order For Woocommerce

Powpy · Published 2025-10-22 · Updated 2025-10-22 · CVE-2025-10570

Mitre

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save refund request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-10570

Affected Products

Flexible Refund/Return Order For Woocommerce

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-10570 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/bd9b6575-f49b-4586-a716-69d39242423d?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3375005/flexible-refund-and-return-order-for-woocommerce · Note