Order Splitter for WooCommerce <= 5.3.8 - Missing Authorization to Authenticated (Subscriber+) Order Split Manipulation and Settings Modification via Multiple AJAX Actions
- ID
- WPSEC-2026-2366
- Plugin
- Order Splitter for WooCommerce (woo-order-splitter)
- Affected
- all versions before 5.3.9
- Remediation
- Update to 5.3.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Order Splitter for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized access to and modification of data because numerous AJAX actions lack capability checks in all versions up to, and including, 5.3.8. The wos_forced_ie, wc_os_group_cat_meta_post and wos_auto_settings actions check no nonce, which makes it possible for authenticated attackers, with Subscriber-level access and above, to force and queue the splitting of arbitrary orders, change category group settings and read the plugin's split settings. The wc_os_save_ie_method_selection, wc_os_update_speed_optimization, wc_os_save_shipping_settings, wos_save_order_status, wos_delete_order_status, wos_update_status_colors, wc_os_update_vendor_role_selection and log actions accept nonces that the plugin prints on every wp-admin page, which makes it possible for attackers who can open wp-admin, Contributor-level and above under WooCommerce's default admin restriction, to change plugin, shipping and vendor settings, create or delete custom order statuses, and clear logs.
References
- https://wpsec.com/vuln/WPSEC-2026-2366/
- https://plugins.svn.wordpress.org/woo-order-splitter/tags/5.3.9/
- https://wordpress.org/plugins/woo-order-splitter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS