What is the CVSS score of CVE-2025-49352?

CVE-2025-49352 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-49352

MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2025-12-31 audit@patchstack.com

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.3 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 31, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.

AnalysisAI

Authorization bypass in Order Cancellation & Returns for WooCommerce plugin (versions ≤1.1.11) allows unauthenticated or low-privileged users to access and manipulate order cancellation and return functionality through user-controlled parameters. The vulnerability stems from improper access control checks that fail to validate user permissions against the requested resource, enabling attackers to operate on orders belonging to other customers without proper authorization. EPSS score of 0.01% indicates low observed exploitation likelihood despite the straightforward attack vector.

Technical ContextAI

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a variant of Insecure Direct Object Reference (IDOR). The WordPress plugin Order Cancellation & Returns for WooCommerce implements order management endpoints that accept user-supplied identifiers (likely order IDs or cancellation/return request IDs) without adequately verifying that the requesting user owns or has permission to modify the referenced resource. This is a common flaw in WordPress plugins where developers fail to implement proper capability checks (using WordPress functions like current_user_can() with order-specific validation) before processing sensitive operations. The plugin is installed on WooCommerce-enabled WordPress sites, making it relevant to e-commerce deployments.

Affected ProductsAI

Order Cancellation & Returns for WooCommerce plugin (YoOhw Studio) versions from initial release through 1.1.11. The plugin is distributed via WordPress.org plugin repository. Affected installations include all active deployments of this plugin running version 1.1.11 or earlier on WordPress sites with WooCommerce e-commerce functionality.

RemediationAI

Update Order Cancellation & Returns for WooCommerce to version 1.1.12 or later, which addresses the authorization bypass by implementing proper access control validation. WordPress administrators should navigate to Plugins > Installed Plugins, locate 'Order Cancellation & Returns for WooCommerce', and click Update if available. For sites unable to immediately patch, temporary mitigation involves restricting access to the plugin's functionality through Web Application Firewall (WAF) rules or by disabling the plugin until an update is applied. Verify the patch installation by confirming the updated version in plugin details, then test order cancellation/return workflows as an authorized user to confirm functionality remains intact. Additional details and the security advisory are available at the Patchstack vulnerability database entry referenced below.