WooCommerce Refund Request Plugin Missing Authorization Vulnerability on WordPress

A vulnerability exists in the Refund Request for WooCommerce plugin for WordPress, all versions through 1.0, due to a lack of proper capability checks in the 'update_refund_status' function. This flaw allows authenticated attackers with Subscriber-level access or higher to unauthorizedly modify refund statuses, changing them to approved or rejected.

Impact

Exploitation of this vulnerability allows for unauthorized users to change refund statuses, potentially leading to financial discrepancies or abuse of the refund process.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.