Vulnerabilities / Order Splitter for WooCommerce / WPSEC-2026-2367
Order Splitter for WooCommerce <= 5.3.8 - Missing Authorization to Unauthenticated Order Totals Recalculation, Log Clearing and Test Email Sending
Medium 5.3
CWE-862Fixed in 5.3.9
- ID
- WPSEC-2026-2367
- Plugin
- Order Splitter for WooCommerce (woo-order-splitter)
- Affected
- all versions before 5.3.9
- Remediation
- Update to 5.3.9 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Order Splitter for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via several debug and maintenance request parameters (get_keys, wc_os_clear_order_log, wc-os-email-testing and wc-os-quick-email-testing) in all versions up to, and including, 5.3.8. This is due to missing capability checks in functions that run on the admin_init hook. This makes it possible for unauthenticated attackers to recalculate the totals of arbitrary orders, clear the plugin's order log and, when the plugin's email log option is on, send test emails to the site administrator.
References
- https://wpsec.com/vuln/WPSEC-2026-2367/
- https://plugins.svn.wordpress.org/woo-order-splitter/tags/5.3.9/
- https://wordpress.org/plugins/woo-order-splitter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS