Flexible Refund WooCommerce CVE-2025-10570
MEDIUMSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-reachable function callable by any authenticated subscriber (PR:L, AC:L, UI:N); impact is limited to integrity of refund records (I:L) with no confidentiality or availability effect.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.
AnalysisAI
Authenticated WordPress users with subscriber-level privileges or above can submit refund requests against arbitrary WooCommerce orders they do not own in the Flexible Refund and Return Order for WooCommerce plugin through version 1.0.38, because the save_refund_request() function performs no ownership or authorization check on the supplied order identifier (CWE-639). The impact is integrity-only - unauthorized refund requests are created in the store's workflow, but there is no confidentiality or availability impact, and no administrative access or user interaction is required once a low-privilege account exists. Exploitation is trivial where the store allows open customer/subscriber registration, but this is a genuine-but-low-priority issue: there is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and EPSS is 0.19% (8th percentile).
Technical ContextAI
The vulnerability is an instance of CWE-639, Authorization Bypass Through User-Controlled Key, in a WordPress plugin that extends WooCommerce's refund and return workflow. The plugin exposes an action handled by save_refund_request() that accepts an order identifier supplied by the caller; control flow reaches the refund-creation logic without validating that the current user owns the referenced order or holds a role entitled to act on it. WooCommerce order IDs are sequential, making the user-controlled key trivially enumerable. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N confirms the operation is network-reachable, low complexity, and requires only low privileges (PR:L) - i.e., an authenticated subscriber-level account on the WordPress installation - with no user interaction and no scope change. The WordPress plugin repository changeset 3375005 (plugins.trac.wordpress.org) is the upstream fix that closes this gap, and Wordfence's advisory (bd9b6575-f49b-4586-a716-69d39242423d) documents the disclosure. Note that the supplied tag labels this an 'Authentication Bypass', but the authoritative classification and vector describe broken access control / IDOR on a user-controlled key rather than a credential or session bypass.
Affected ProductsAI
Flexible Refund and Return Order for WooCommerce (WordPress plugin), all versions up to and including 1.0.38, are affected; the primary advisory and upstream changeset are at https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9b6575-f49b-4586-a716-69d39242423d?source=cve and https://plugins.trac.wordpress.org/changeset/3375005/flexible-refund-and-return-order-for-woocommerce. Exploitation requires the plugin to be active on a WordPress site with WooCommerce installed and at least one low-privilege account (subscriber role or above) available to the attacker, which is the default registration outcome on many WooCommerce shops. No CPE strings were supplied with this record, so version identification should be performed by inspecting the plugin header version on the target site rather than by CPE matching.
RemediationAI
Upgrade the Flexible Refund and Return Order for WooCommerce plugin beyond version 1.0.38 as soon as a patched release is available from the WordPress plugin repository; the upstream code fix is published as changeset 3375005 (https://plugins.trac.wordpress.org/changeset/3375005/flexible-refund-and-return-order-for-woocommerce), and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9b6575-f49b-4586-a716-69d39242423d?source=cve should be consulted to confirm the exact fixed release - the specific patched version number is not independently confirmed in this data, so verify the plugin header after updating. As a compensating control while patching, disable the plugin if refund/return handling is not actively in use (trade-off: customers lose the self-service return workflow and store staff must process returns manually), or restrict who can reach the vulnerable endpoint by removing the subscriber role's ability to trigger refund requests and gating the action behind a capability check via a small custom plugin (trade-off: requires maintenance and must be re-validated after each plugin update). Where refund activity is business-critical, also reduce the attack surface by disabling open registration or requiring approval for new accounts so that arbitrary visitors cannot self-provision the subscriber-level account the exploit depends on (trade-off: increased friction for legitimate customers and potential loss of sales); additionally, monitor new refund requests for order IDs that do not match the requesting user's purchase history.
More in Woocommerce
View allThe WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by
Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync
Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today