PT-2025-45557 · Unknown+1 · Woocommerce+1

Powpy · Published 2025-11-08 · Updated 2025-11-08 · CVE-2025-12621

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Flexible Refund and Return Order for WooCommerce plugin for WordPress versions through 1.0.42

Description The Flexible Refund and Return Order for WooCommerce plugin for WordPress has a flaw where data can be altered without proper authorization. This is caused by an incorrect capability check within the create refund function. Authenticated attackers possessing Contributor-level access or higher can change the status of refund requests, including approving or denying them.

Recommendations Update the Flexible Refund and Return Order for WooCommerce plugin to a version later than 1.0.42.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-12621

Affected Products

Flexible Refund/Return Order For Woocommerce

Woocommerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12621 · Security Note
• https://plugins.trac.wordpress.org/browser/flexible-refund-and-return-order-for-woocommerce/trunk/vendor_prefixed/wpdesk/flexible-refunds-core/src/Integration/Ajax.php#L55 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/8498c671-b46e-420c-a482-7c6983596753?source=cve · Note
• https://t.me/cveNotify/142204 · Telegram Post
• https://t.me/CVEtracker/36858 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?old=3378649%40flexible-refund-and-return-order-for-woocommerce%2Ftags%2F1.0.42&new=3390898%40flexible-refund-and-return-order-for-woocommerce%2Ftags%2F1.0.43 · Note
• https://twitter.com/CVEnew/status/1987062031896502506 · Twitter Post