The Refund Request for WooCommerce plugin for WordPress contains a missing capability check on the update_refund_status function. As a result, authenticated users with Subscriber-level access and above can change any refund status to approved or rejected. This flaw amounts to a flaw in authorization control, as categorized by CWE‑862, and allows attackers to alter transaction records without proper admin privileges.

The vulnerability afflicts the sunarc "Refund Request for WooCommerce" plugin for WordPress. All released versions up to and including version 1.0 are affected. The issue resides in the plugin’s logic that processes refund status updates.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1% shows a very low likelihood of exploitation at the time of this analysis. The flaw is not listed in the CISA KEV catalog. A likely attack path requires the attacker to have legitimate login credentials of a Subscriber or higher role, after which the missing authorization check permits misuse of the refund status update endpoint. The risk is confined to administrators who allow Subscriber-level roles the ability to modify refunds, and the impact is the potential for fraudulent refund approvals or denials.