The Flexible Refund and Return Order for WooCommerce plugin suffers from an authorization bypass vulnerability (CWE-639) in the save_refund_request() function. Authenticated users with subscriber-level privileges or above can exploit this flaw to submit refund requests on arbitrary orders without ownership verification. This vulnerability affects all plugin versions up to and including 1.0.38. The CVSS 3.1 base score is 4.3 (medium severity), reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact. No patch or remediation details are currently provided by the vendor.

An attacker with subscriber-level access can submit refund requests for orders they do not own, potentially causing unauthorized refund processing. This impacts the integrity of the refund process but does not affect confidentiality or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access to trusted users only and monitor refund request activities for anomalies. Avoid granting unnecessary privileges to users. Follow vendor updates closely for an official fix.