Threats tagged 'ghsa-v538-gr8w-jr93'

The Flexible Refund and Return Order for WooCommerce plugin for WordPress contains a vulnerability in its 'create_refund' function that allows authenticated users with Contributor-level access or higher to modify refund request statuses without proper authorization. This affects all versions up to and including 1.0.42 and enables unauthorized approval or refusal of refunds.