{"cve":"CVE-2025-49352","enrichment":{"created":"2026-01-05T10:15:42.197008+00:00","updated":"2026-04-30T04:30:27.679131+00:00","vendors":["woocommerce","woocommerce$PRODUCT$woocommerce","wordpress","wordpress$PRODUCT$wordpress","yoohw_studio","yoohw_studio$PRODUCT$order_cancellation_&_returns_for_woocommerce"]},"epss":{"score":0.00249},"mitre":{"cpes":[],"created":"2025-12-31T16:25:44.989000+00:00","description":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"cvssV4_0":{}},"mitre_repo_path":"cves/2025/49xxx/CVE-2025-49352.json","references":["https://patchstack.com/database/Wordpress/Plugin/wc-order-cancellation-return/vulnerability/wordpress-order-cancellation-returns-for-woocommerce-plugin-1-1-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve"],"title":"WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability","updated":"2026-04-28T16:13:02.124000+00:00","vendors":[],"weaknesses":["CWE-639"]},"nvd":{"cpes":[],"created":"2025-12-31T17:15:44.267000+00:00","description":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"cvssV4_0":{}},"nvd_repo_path":"2025/CVE-2025-49352.json","references":["https://patchstack.com/database/Wordpress/Plugin/wc-order-cancellation-return/vulnerability/wordpress-order-cancellation-returns-for-woocommerce-plugin-1-1-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve"],"title":null,"updated":"2026-09-23T17:10:00.210000+00:00","vendors":[],"weaknesses":["CWE-639"]},"opencve":{"changes":[{"created":"2025-12-31T16:45:00+00:00","data":[{"details":{"new":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through 1.1.10.","old":null},"type":"description"},{"details":{"new":"WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability","old":null},"type":"title"},{"details":{"added":["CWE-639"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://vdp.patchstack.com/database/wordpress/plugin/wc-order-cancellation-return/vulnerability/wordpress-order-cancellation-returns-for-woocommerce-plugin-1-1-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve"],"removed":[]},"type":"references"},{"details":{"added":{"cvssV3_1":{"score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"12288093-b5e5-421c-8a87-1be1e1a8b021"},{"created":"2025-12-31T18:15:00+00:00","data":[{"details":{"added":{"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"bdb7e7b4-e857-4501-a830-fa938e2bbec4"},{"created":"2026-01-05T10:45:00+00:00","data":[{"details":["woocommerce","woocommerce$PRODUCT$woocommerce","wordpress","wordpress$PRODUCT$wordpress","yoohw_studio","yoohw_studio$PRODUCT$order_cancellation_&_returns_for_woocommerce"],"type":"first_time"},{"details":{"added":["woocommerce","woocommerce$PRODUCT$woocommerce","wordpress","wordpress$PRODUCT$wordpress","yoohw_studio","yoohw_studio$PRODUCT$order_cancellation_&_returns_for_woocommerce"],"removed":[]},"type":"vendors"}],"id":"09ac5595-8661-4de6-8ac0-62491a7d3c14"},{"created":"2026-01-20T14:45:00+00:00","data":[{"details":{"added":["https://patchstack.com/database/wordpress/plugin/wc-order-cancellation-return/vulnerability/wordpress-order-cancellation-returns-for-woocommerce-plugin-1-1-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve"],"removed":[]},"type":"references"}],"id":"6e49a0e3-b6f0-41f8-bf61-fd910a4f29fc"},{"created":"2026-01-20T15:30:00+00:00","data":[{"details":{"added":[],"removed":["https://vdp.patchstack.com/database/wordpress/plugin/wc-order-cancellation-return/vulnerability/wordpress-order-cancellation-returns-for-woocommerce-plugin-1-1-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve"]},"type":"references"}],"id":"978d4e83-8848-472e-89c3-11d58892e337"},{"created":"2026-04-01T23:45:00+00:00","data":[{"details":{"new":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation &amp; Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation &amp; Returns for WooCommerce: from n/a through <= 1.1.11.","old":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through 1.1.10."},"type":"description"},{"details":{"added":["https://patchstack.com/database/Wordpress/Plugin/wc-order-cancellation-return/vulnerability/wordpress-order-cancellation-returns-for-woocommerce-plugin-1-1-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve"],"removed":["https://patchstack.com/database/wordpress/plugin/wc-order-cancellation-return/vulnerability/wordpress-order-cancellation-returns-for-woocommerce-plugin-1-1-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve"]},"type":"references"},{"details":{"added":{},"removed":{"cvssV3_1":{"score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}},"updated":{}},"type":"metrics"}],"id":"ba605b9c-3876-4e49-87e9-cfd2098daec9"},{"created":"2026-04-23T15:00:00+00:00","data":[{"details":{"added":{"cvssV3_1":{"score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"a83f1eaf-0f3a-4d80-99a7-6bca833a1b4f"},{"created":"2026-04-28T18:30:00+00:00","data":[{"details":{"new":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.","old":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation &amp; Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation &amp; Returns for WooCommerce: from n/a through <= 1.1.11."},"type":"description"}],"id":"12dc4980-1c73-4bcb-9f9a-7a672eb23f7a"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2025-12-31T16:25:44.989000+00:00","provider":"mitre"},"description":{"data":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00249},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"},"provider":"vulnrichment"},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://patchstack.com/database/Wordpress/Plugin/wc-order-cancellation-return/vulnerability/wordpress-order-cancellation-returns-for-woocommerce-plugin-1-1-10-insecure-direct-object-references-idor-vulnerability?_s_id=cve"],"providers":["mitre","nvd"]},"title":{"data":"WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability","provider":"mitre"},"updated":{"data":"2026-04-28T16:13:02.124000+00:00","provider":"mitre"},"vendors":{"data":["woocommerce","woocommerce$PRODUCT$woocommerce","wordpress","wordpress$PRODUCT$wordpress","yoohw_studio","yoohw_studio$PRODUCT$order_cancellation_&_returns_for_woocommerce"],"providers":["enrichment"]},"weaknesses":{"data":["CWE-639"],"providers":["mitre","nvd"]}},"vulnrichment":{"cpes":[],"created":"2025-12-31T16:25:44.989000+00:00","description":"Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation &amp; Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation &amp; Returns for WooCommerce: from n/a through <= 1.1.11.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{},"kev":{},"ssvc":{"options":{"Automatable":"no","Exploitation":"none","Technical Impact":"partial"},"version":"2.0.3"}},"references":[],"title":"WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability","updated":"2025-12-31T17:33:12.751000+00:00","vendors":[],"vulnrichment_repo_path":"2025/49xxx/CVE-2025-49352.json","weaknesses":[]}}