The Flexible Refund and Return Order for WooCommerce plugin contains a misconfigured capability check in its create_refund function. Consequently, any user with Contributor level access or higher can alter the status of refund requests, allowing an attacker to approve or reject refunds without permission. This flaw is a classic example of a missing authorization vulnerability (CWE-863) and compromises data integrity by enabling the manipulation of financial records.

All installations of wpdesk Flexible Refund and Return Order for WooCommerce version 1.0.42 and earlier are affected. These are WordPress plugins that extend WooCommerce on e‑commerce sites. Any WooCommerce store that has installed an affected version of the plugin must assess whether it is vulnerable.

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, which further reduces perceived risk. Attackers would need authenticated access with at least Contributor privileges to exploit this flaw, making the primary attack vector authenticated. Once authenticated, they could invoke the Ajax endpoint that bypasses the capability check to change refund statuses.