CVE-2025-10570
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-10-22

Last updated on: 2025-10-22

Assigner: Wordfence

Description
The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-10-22
Last Modified
2025-10-22
Generated
2026-07-06
AI Q&A
2025-10-22
EPSS Evaluated
2026-07-05
NVD
CVE-2025-10570
EUVD
EUVD-2025-35351

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
woocommerce flexible_refund_and_return_order 1.0.38

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Flexible Refund and Return Order for WooCommerce plugin for WordPress, affecting all versions up to and including 1.0.38. It is a Missing Authorization vulnerability in the save_refund_request() function, which allows authenticated users with subscriber-level access or higher to submit refund requests for orders they do not own.

Impact Analysis

An attacker with subscriber-level access or above can exploit this vulnerability to submit unauthorized refund requests for arbitrary orders. This could lead to fraudulent refund claims, financial loss, and disruption of order management processes.

Mitigation Strategies

Update the Flexible Refund and Return Order for WooCommerce plugin to a version later than 1.0.38 where the missing authorization issue in the save_refund_request() function has been fixed. [1]

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10570. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart