CVE-2025-49352: 
WordPress vulnerability analysis and mitigation

CVE-2025-49352 is an Authorization Bypass Through User-Controlled Key (IDOR) vulnerability in the "Order Cancellation & Returns for WooCommerce" WordPress plugin developed by YoOhw Studio. It allows authenticated low-privileged users (e.g., subscribers) to bypass access controls and manipulate order data by supplying user-controlled object references. The vulnerability affects all plugin versions through 1.1.12, with version 1.1.13 being the first patched release. It was reported on October 13, 2025, and publicly disclosed on December 31, 2025, by Patchstack. The CVSS v3.1 base score is 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-639 (Authorization Bypass Through User-Controlled Key), commonly known as Insecure Direct Object Reference (IDOR), and maps to OWASP Top 10 A1: Broken Access Control. The plugin fails to properly validate whether an authenticated user is authorized to access or modify a specific order object when the object identifier (e.g., order ID) is supplied directly by the user in a request. An attacker with at least Subscriber-level access can craft requests referencing arbitrary order IDs to trigger cancellation or return actions on orders they do not own. No complex exploitation techniques or chained vulnerabilities are required (Patchstack).

Successful exploitation allows an authenticated attacker to manipulate the integrity of WooCommerce order data — specifically, triggering unauthorized order cancellations or return requests on orders belonging to other customers. The impact is limited to integrity (no confidentiality or availability impact per the CVSS assessment), meaning attackers cannot read sensitive order data or crash the service, but can disrupt order fulfillment workflows and cause financial or operational harm to affected merchants. The scope is limited to the WordPress site running the vulnerable plugin and does not facilitate lateral movement beyond the application layer (Patchstack, Feedly).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that while IDOR-class vulnerabilities can be used in mass-exploit campaigns targeting WordPress sites, this specific issue is assessed as low priority and unlikely to be exploited in practice (Patchstack).

1. Reconnaissance: Identify WordPress sites running the "Order Cancellation & Returns for WooCommerce" plugin (slug: wc-order-cancellation-return) in versions ≤ 1.1.12, using tools like WPScan or by inspecting plugin directories.
2. Obtain low-privileged access: Register or log in as a Subscriber-level user on the target WordPress/WooCommerce site.
3. Enumerate order IDs: Identify valid WooCommerce order IDs belonging to other customers by guessing sequential integers or observing order confirmation pages.
4. Craft malicious request: Submit a cancellation or return request (e.g., via the plugin's frontend form or direct HTTP request) with a manipulated order ID parameter referencing another user's order.
5. Achieve unauthorized action: Due to missing server-side ownership validation, the plugin processes the request and modifies the targeted order's status (e.g., marks it as cancelled or initiates a return), impacting the legitimate order owner and merchant (Patchstack).

• Logs: WordPress/WooCommerce access logs showing authenticated requests to order cancellation or return endpoints with order IDs not associated with the authenticated user's account; repeated requests cycling through sequential order IDs from a single user session.
• Application: Unexpected order status changes (e.g., orders moved to "Cancelled" or "Return Requested") for orders not initiated by the order owner; WooCommerce order notes showing cancellation/return actions attributed to a different customer account.
• Network: Unusual patterns of POST requests to plugin-specific endpoints (e.g., URLs containing wc-order-cancellation-return) from a single IP or user account in a short time window.

The vendor has released version 1.1.13 of the "Order Cancellation & Returns for WooCommerce" plugin, which patches this vulnerability. Site administrators should update the plugin to version 1.1.13 or later immediately via the WordPress admin dashboard or by downloading the updated plugin from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. No configuration-based workaround is available; updating is the only recommended remediation (Patchstack).