Executive Summary

This vulnerability exists in the Flexible Refund and Return Order for WooCommerce plugin for WordPress, affecting all versions up to and including 1.0.38. It is a Missing Authorization vulnerability in the save_refund_request() function, which allows authenticated users with subscriber-level access or higher to submit refund requests for orders they do not own.

Useful 0 Not Useful 0

Impact Analysis

An attacker with subscriber-level access or above can exploit this vulnerability to submit unauthorized refund requests for arbitrary orders. This could lead to fraudulent refund claims, financial loss, and disruption of order management processes.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Flexible Refund and Return Order for WooCommerce plugin to a version later than 1.0.38 where the missing authorization issue in the save_refund_request() function has been fixed. [1]

Useful 0 Not Useful 0