# Order Splitter for WooCommerce <= 5.3.8 - Missing Authorization to Authenticated (Subscriber+) Order Split Manipulation and Settings Modification via Multiple AJAX Actions

- **ID:** WPSEC-2026-2366
- **Plugin:** Order Splitter for WooCommerce (`woo-order-splitter`), https://wordpress.org/plugins/woo-order-splitter/
- **Affected versions:** all versions before 5.3.9
- **Fixed in:** 5.3.9 (Update to 5.3.9 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-order-splitter
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2366/

## Description

The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized access to and modification of data because numerous AJAX actions lack capability checks in all versions up to, and including, 5.3.8. The wos_forced_ie, wc_os_group_cat_meta_post and wos_auto_settings actions check no nonce, which makes it possible for authenticated attackers, with Subscriber-level access and above, to force and queue the splitting of arbitrary orders, change category group settings and read the plugin's split settings. The wc_os_save_ie_method_selection, wc_os_update_speed_optimization, wc_os_save_shipping_settings, wos_save_order_status, wos_delete_order_status, wos_update_status_colors, wc_os_update_vendor_role_selection and log actions accept nonces that the plugin prints on every wp-admin page, which makes it possible for attackers who can open wp-admin, Contributor-level and above under WooCommerce's default admin restriction, to change plugin, shipping and vendor settings, create or delete custom order statuses, and clear logs.

## References

- https://wpsec.com/vuln/WPSEC-2026-2366/
- https://plugins.svn.wordpress.org/woo-order-splitter/tags/5.3.9/
- https://wordpress.org/plugins/woo-order-splitter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2366/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.