Flexible Refund and Return Order for WooCommerce Incorrect Authorization Vulnerability

A vulnerability exists in the Flexible Refund and Return Order for WooCommerce plugin for WordPress, in all versions through 1.0.42. The issue arises from a misconfigured capability check in the 'create_refund' function, allowing authenticated attackers with Contributor-level access and above to unauthorizedly modify refund request statuses, including approval and denial.

Impact

Exploitation of this vulnerability allows for unauthorized users to change the status of refund requests, potentially leading to financial loss or abuse of the refund process.

Remediation

Users can update to version 1.0.43 or a newer patched version to address this vulnerability.