CVE-2025-12621: WooCommerce Refund Plugin Auth Bypass Flaw

CVE-2025-12621 Overview

CVE-2025-12621 is a broken access control vulnerability [CWE-863] in the Flexible Refund and Return Order for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.0.42. A misconfigured capability check on the create_refund function allows authenticated users with Contributor-level access or higher to modify refund request statuses. Attackers can approve or refuse refund requests they should not control.

Critical Impact
Low-privileged authenticated users can approve or refuse WooCommerce refund requests, causing financial impact and workflow disruption for store operators.

Affected Products

Flexible Refund and Return Order for WooCommerce plugin for WordPress — all versions through 1.0.42
WordPress sites running WooCommerce with the affected plugin installed
Vendor: WP Desk (wpdesk/flexible-refunds-core)

Discovery Timeline

2025-11-08 - CVE-2025-12621 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12621

Vulnerability Analysis

The vulnerability resides in the create_refund AJAX handler defined in vendor_prefixed/wpdesk/flexible-refunds-core/src/Integration/Ajax.php. The handler does not enforce an appropriate capability check before mutating refund state. WordPress Contributors — a role intended only for drafting posts — can invoke the AJAX endpoint and change the outcome of refund requests. This breaks the trust boundary between content contributors and store administrators.

The issue is classified as an incorrect authorization weakness [CWE-863]. The vulnerable code path validates that the request is authenticated but fails to confirm that the caller holds a role such as shop_manager or administrator. As a result, any user account with Contributor privileges or above can trigger state changes on refund records.

Root Cause

The root cause is a capability check that does not match the sensitivity of the action being performed. The create_refund function should require WooCommerce management capabilities such as manage_woocommerce. Instead, the check either uses a broader capability or relies solely on nonce validation, which any authenticated user can obtain.

Attack Vector

An attacker first obtains Contributor-level access, either through registration on sites that allow it or through compromise of an existing low-privileged account. The attacker then submits a crafted AJAX POST request to the plugin's create_refund endpoint with parameters that approve or refuse a targeted refund. The server processes the request without verifying that the caller manages the store.

The vulnerability affects confidentiality minimally but allows unauthorized modification of refund state, which impacts store revenue and customer service workflows. See the Wordfence Vulnerability Overview for additional analysis. The vulnerable function is visible in the WordPress Plugin Source Code.

Detection Methods for CVE-2025-12621

Indicators of Compromise

Unexpected refund status changes on WooCommerce orders, particularly approvals or refusals attributed to non-administrative user accounts.
AJAX POST requests to admin-ajax.php with an action parameter targeting the plugin's create_refund handler originating from Contributor, Author, or Editor accounts.
New or dormant low-privileged accounts that suddenly interact with WooCommerce order or refund endpoints.

Detection Strategies

Review WordPress activity logs for create_refund invocations correlated with user role metadata to identify calls from non-store-manager roles.
Compare refund status change events against the acting user's assigned capabilities and flag mismatches.
Enable WooCommerce order audit logging and alert on refund state transitions occurring outside normal administrator sessions.

Monitoring Recommendations

Monitor admin-ajax.php traffic for unusual volumes of refund-related actions from single accounts or IP addresses.
Track authentication events for Contributor-level and above accounts, especially failed logins followed by successful ones.
Alert on installations of the plugin that remain at version 1.0.42 or earlier after the patch release.

How to Mitigate CVE-2025-12621

Immediate Actions Required

Update the Flexible Refund and Return Order for WooCommerce plugin to version 1.0.43 or later on all WordPress sites.
Audit all user accounts with Contributor role or higher and remove accounts that are unused or unrecognized.
Review recent refund request activity for unauthorized status changes and reverse them where required.

Patch Information

The vendor released version 1.0.43 to correct the capability check in the create_refund handler. The code changes are documented in the WordPress Plugin Changeset between tags 1.0.42 and 1.0.43.

Workarounds

If patching is not immediately possible, disable the Flexible Refund and Return Order for WooCommerce plugin until the update can be applied.
Restrict new user registration or set the default role to Subscriber to reduce the pool of accounts that meet the Contributor threshold.
Deploy a web application firewall rule that blocks POST requests to admin-ajax.php with the plugin's refund action parameter from non-administrator sessions.

bash

# Configuration example: force default role to subscriber in wp-config.php
# and update the plugin via WP-CLI
wp plugin update flexible-refund-and-return-order-for-woocommerce --version=1.0.43
wp option update default_role subscriber