Flexible Refund and Return Order for WooCommerce Missing Authorization Vulnerability

A vulnerability exists in the Flexible Refund and Return Order for WooCommerce plugin for WordPress, in all versions through 1.0.38. The issue arises from the save_refund_request() function, which lacks proper authorization checks. This flaw allows authenticated attackers with subscriber-level access or higher to submit refund requests for orders they do not own.

Impact

Exploitation of this vulnerability allows for unauthorized refund requests to be processed, potentially leading to financial loss or abuse of the refund system.

Remediation

Users are advised to update the plugin to version 1.0.39 or later.