CVE-2025-12634 is a missing authorization vulnerability (CWE-862) in the Refund Request for WooCommerce plugin for WordPress. The issue arises because the 'update_refund_status' function lacks a capability check, enabling authenticated users with low privileges (Subscriber-level and above) to update refund statuses to approved or rejected. This vulnerability affects all versions up to and including 1.0 of the plugin. The CVSS 3.1 base score is 4.3, reflecting a network attack vector with low privileges required, no user interaction, and impact limited to integrity.

An attacker with Subscriber-level access or higher can modify refund statuses arbitrarily, potentially causing unauthorized approval or rejection of refund requests. This compromises the integrity of refund data but does not affect confidentiality or availability. There is no evidence of known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for unauthorized refund status changes. Avoid granting unnecessary privileges to low-level users.