CVE-2025-10570

MediumCVSS 4.3/10Last modified Oct 8, 2026

Description

The Flexible Refund and Return Order for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.38 via the save_refund_request() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit refund requests for arbitrary orders that they do not own.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 22, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-105719.6Authentication Bypass Using an Alternate Path or Channel vulnerability in ABB ABB Ability Edgenius.This issue affects ABB Ability Edgenius: CVE-2025-105736.1Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript CVE-2025-105756.5The WP jQuery Pager plugin for WordPress is vulnerable to SQL Injection via the 'ids' shortcode attribute parameter handled by the WPJqueryP CVE-2025-105768.5Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, whi CVE-2025-105778.5Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, whi CVE-2025-105787.8A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.47.41.0. The vulnerability could CVE-2025-105795.3The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capabili CVE-2025-10588.1CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is do CVE-2025-105806.4The Widget Options – The #1 WordPress Widget & Block Control Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via mu CVE-2025-105817.8A potential DLL hijacking vulnerability was discovered in the Lenovo PC Manager during an internal security assessment that could allow a lo CVE-2025-105828.8The WP Dispatcher plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.2.0 due CVE-2025-105833.5The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 v