WP Manifestindependent plugin directory
manifest / ecommerce / hdwebmobile-return-refund-requests

HDWebmobile Return & Refund Requests

Let customers request a return on their own orders -- server-computed refund amounts, no file upload anywhere.

by htrxuan - Han Tran · github.com/htrxuan/hdwebmobile-return-refund-requests · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/htrxuan/hdwebmobile-return-refund-requests/archive/refs/heads/master.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.
Readme github.com/htrxuan/hdwebmobile-return-refund-requests ↗

Let customers request a return or refund on their own orders -- server-computed refund amounts, no file upload anywhere.

Description

HDWebmobile Return & Refund Requests adds a "Request a Return or Refund" option to a customer's completed orders, within a return window you configure. You review each request and, if you approve it, the plugin issues a real WooCommerce refund for the order's own exact remaining amount.

Why this plugin exists

The "Return Refund and Exchange" family of competing WooCommerce plugins has had two serious, separately-disclosed vulnerabilities: CVE-2024-13692, an Insecure Direct Object Reference that let an unauthenticated attacker overwrite another customer's refund request message, overwrite their linked refund image, and read their private order messages, because several endpoints trusted a user-controlled key with no ownership check at all; and CVE-2025-6222, an unauthenticated file-upload endpoint that allowed full remote code execution. This plugin closes both by construction:

  • Every return request is looked up and scoped by the real, currently-authenticated customer's own id at the database query itself -- never by trusting a request id or key alone to imply ownership.
  • A request's owner is set exactly once, at creation, derived directly from the real WooCommerce order object's own customer id.
  • There is no file upload anywhere in this plugin -- a return reason is a fixed dropdown plus a plain text note.
  • Refund amounts are always computed fresh from the order's own remaining refundable total -- there is no field anywhere that accepts a refund amount from a request.

Features

  • Customers can request a return directly from their order details page, within a configurable return window
  • A dedicated "Returns" tab under My Account showing request status
  • Approve (issues a real WooCommerce refund and restocks items) or decline, from one admin screen
  • Order notes added automatically at each step for a full audit trail

Limitations (v1)

  • No photo/file evidence upload -- see "Why this plugin exists" above
  • Whole-order returns only -- no per-line-item partial returns yet

Installation

  1. Upload the plugin to /wp-content/plugins/hdwebmobile-return-refund-requests, or install through the WordPress plugins screen.
  2. Activate the plugin. WooCommerce must already be installed and active.
  3. Under WooCommerce > HDWebmobile > Return & Refund Requests, set your return window.

License

GPLv2 or later. See LICENSE.