CVE-2025-10570

Name of the Vulnerable Software and Affected Versions Flexible Refund and Return Order for WooCommerce versions prior to 1.0.39

Description The plugin contains a missing authorization flaw within the save refund request() function. This allows authenticated users with subscriber-level permissions or higher to submit refund requests for orders that do not belong to them.

Recommendations Update the plugin to version 1.0.39 or later. As a temporary mitigation, restrict access to the save refund request() function for users with subscriber-level permissions.