CVE-2025-10570CWE-639

CVE-2025-10570

Medium · published October 22, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
8.7
In the wild
Unconfirmed
What it is

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00195 · 8.7th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-10-22T11:15Z
References (2)
https://plugins.trac.wordpress.org/changeset/3375005/flexible-refund-and-return-order-for-woocommerce · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/bd9b6575-f49b-4586-a716-69d39242423d?source=cve · [email protected]
EPSS history
Timeline
  • 22 OCT 06:40Z
    Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund
    cvelistv5