CVE-2025-12634: Refund Request for WooCommerce <= 1.0 - Missing Authorization to Authenticated (Subscriber+) Refund Status Update
The Refund Request for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updaterefundstatus' function in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update refund statuses to approved or rejected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12634?
The severity of CVE-2025-12634 is considered to be high due to unauthorized data modification risks.
How do I fix CVE-2025-12634?
To fix CVE-2025-12634, update the Refund Request for WooCommerce plugin to the latest version that includes the necessary capability checks.
Who is affected by CVE-2025-12634?
CVE-2025-12634 affects users of the Refund Request for WooCommerce plugin for all versions up to and including 1.0.
What type of vulnerability is CVE-2025-12634?
CVE-2025-12634 is an unauthorized modification vulnerability due to a missing capability check.
What are the potential consequences of CVE-2025-12634?
The potential consequences of CVE-2025-12634 include unauthorized changes to refund statuses by authenticated attackers.