HDWebmobile Return & Refund Requests

HDWebmobile Return & Refund Requests

Let customers request a return or refund on their own completed orders — every request, message, and admin action is scoped to the order’s real customer id, never a client-supplied identifier.

Overview

HDWebmobile Return & Refund Requests adds a “Request a Return or Refund” option to a customer’s completed orders, within a return window you configure. You review each request and, if you approve it, the plugin issues a real WooCommerce refund for the order’s own exact remaining amount.

The “Return Refund and Exchange” family of competing WooCommerce plugins has had two serious, separately-disclosed vulnerabilities: CVE-2024-13692, an Insecure Direct Object Reference that let an unauthenticated attacker overwrite another customer’s refund request message, overwrite their linked refund image, and read their private order messages, because several endpoints trusted a user-controlled key with no ownership check at all; and CVE-2025-6222, an unauthenticated file-upload endpoint that allowed full remote code execution. This plugin closes both vulnerability classes by construction: every return request is looked up and scoped by the real, currently-authenticated customer’s own id at the database query itself — never by trusting a request id or key alone to imply ownership. A request’s owner is set exactly once, at creation, derived directly from the real WooCommerce order object’s own customer id. There is no file upload anywhere in this plugin — a return reason is a fixed dropdown plus a plain text note. When you approve a request, the refund amount is always computed fresh from the order’s own remaining refundable total — there is no field anywhere that accepts a refund amount from a request.

Key Features

• Customers can request a return directly from their order details page, within a configurable return window
• A dedicated “Returns” tab under My Account showing request status
• Approve (issues a real WooCommerce refund and restocks items) or decline, from one admin screen
• Order notes are added automatically at each step for a full audit trail

Limitations

Please read before installing:

• No photo/file evidence upload in this version — see Overview above for why
• Whole-order returns only in this version — no per-line-item partial returns yet

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-return-refund-requests directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Set your return window under the plugin’s settings; customers can then request returns from their completed orders.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: customer-initiated return requests within a configurable window, one-screen approve/decline, real WooCommerce refunds on approval, automatic order-note audit trail.)

See our other WordPress plugins for more WooCommerce and site-utility tools.