CVE-2025-49352
Lifecycle Timeline
2Description
Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.
Analysis
Authorization bypass in Order Cancellation & Returns for WooCommerce plugin (versions ≤1.1.11) allows unauthenticated or low-privileged users to access and manipulate order cancellation and return functionality through user-controlled parameters. The vulnerability stems from improper access control checks that fail to validate user permissions against the requested resource, enabling attackers to operate on orders belonging to other customers without proper authorization. EPSS score of 0.01% indicates low observed exploitation likelihood despite the straightforward attack vector.
Technical Context
The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), a variant of Insecure Direct Object Reference (IDOR). The WordPress plugin Order Cancellation & Returns for WooCommerce implements order management endpoints that accept user-supplied identifiers (likely order IDs or cancellation/return request IDs) without adequately verifying that the requesting user owns or has permission to modify the referenced resource. This is a common flaw in WordPress plugins where developers fail to implement proper capability checks (using WordPress functions like current_user_can() with order-specific validation) before processing sensitive operations. The plugin is installed on WooCommerce-enabled WordPress sites, making it relevant to e-commerce deployments.
Affected Products
Order Cancellation & Returns for WooCommerce plugin (YoOhw Studio) versions from initial release through 1.1.11. The plugin is distributed via WordPress.org plugin repository. Affected installations include all active deployments of this plugin running version 1.1.11 or earlier on WordPress sites with WooCommerce e-commerce functionality.
Remediation
Update Order Cancellation & Returns for WooCommerce to version 1.1.12 or later, which addresses the authorization bypass by implementing proper access control validation. WordPress administrators should navigate to Plugins > Installed Plugins, locate 'Order Cancellation & Returns for WooCommerce', and click Update if available. For sites unable to immediately patch, temporary mitigation involves restricting access to the plugin's functionality through Web Application Firewall (WAF) rules or by disabling the plugin until an update is applied. Verify the patch installation by confirming the updated version in plugin details, then test order cancellation/return workflows as an authorized user to confirm functionality remains intact. Additional details and the security advisory are available at the Patchstack vulnerability database entry referenced below.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today