The issue is an insecure direct object reference in the WooCommerce order cancellation and return functions of the Order Cancellation & Returns for WooCommerce plugin. An attacker who can authenticate to the site can manipulate the order identifiers in the plugin’s requests to cancel or return orders that do not belong to them. The vulnerability is a CWE‑639 style authorization bypass that allows the attacker to perform privileged actions on arbitrary orders, potentially leading to financial loss and compromise of business logic integrity.

YoOhw Studio’s Order Cancellation & Returns for WooCommerce plugin for WordPress is affected. All releases up through and including version 1.1.11 are vulnerable. If your website runs any of those versions, it is at risk.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low current exploitation probability; the issue is not listed in the CISA KEV catalog. Exploitation requires a logged‑in user to manipulate the order identifier in the cancellation or return request, a straightforward HTTP request to the plugin endpoint. If successful, the attacker bypasses normal authorization checks and can delete or revert any order without restriction.