Vulnerability · Published Oct 22, 2025 · Assigned by Wordfence

CVE-2025-10570Flexible Refund and Return Order for WooCommerce <= 1.0.38 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Refund

Medium 4.3

In plain English

A medium-severity authorization bypass via user-controlled key in Flexible Refund and Return Order for WooCommerce from wpdesk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)0.2%top 90.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.

Affected products (as reported)

Vendor	Product	Versions
wpdesk	Flexible Refund and Return Order for WooCommerce	0 – through 1.0.38

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

In plain English

Official description

Affected products (as reported)

References