CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.
Explanation of Vulnerability in Simple Terms
The Order Cancellation & Returns for WooCommerce plugin through version 1.1.11 contains an authorization flaw that allows authenticated users to modify order data they should not have access to. An attacker with a low-privilege account can alter order information through the plugin's functions. The vulnerability has low integrity impact and requires valid site credentials to exploit.
What an attacker can do
Modify order data or settings belonging to other users or orders via the plugin interface.
Potential impact on your site
Order records may be altered by unauthorized users, potentially affecting order fulfillment, refunds, or customer data integrity.
Conditions required to exploit
Attacker must have a valid low-privilege account on the WooCommerce site (e.g., customer or subscriber role).
Key dates
External resources
Related vulnerabilities
