{
 "id": "WPSEC-2026-2367",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2367/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2367/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2367/index.md",
 "title": "Order Splitter for WooCommerce <= 5.3.8 - Missing Authorization to Unauthenticated Order Totals Recalculation, Log Clearing and Test Email Sending",
 "description": "The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via several debug and maintenance request parameters (get_keys, wc_os_clear_order_log, wc-os-email-testing and wc-os-quick-email-testing) in all versions up to, and including, 5.3.8. This is due to missing capability checks in functions that run on the admin_init hook. This makes it possible for unauthenticated attackers to recalculate the totals of arbitrary orders, clear the plugin's order log and, when the plugin's email log option is on, send test emails to the site administrator.",
 "plugin": {
  "slug": "woo-order-splitter",
  "name": "Order Splitter for WooCommerce",
  "full_name": "Order Splitter for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/woo-order-splitter/",
  "advisories_url": "https://wpsec.com/vuln/plugin/woo-order-splitter/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/woo-order-splitter"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.9",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.9"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.9",
 "remediation": "Update to 5.3.9 or later.",
 "fix_released": "2026-10-30T23:08:47+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:40:45.122443+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2367/",
  "https://plugins.svn.wordpress.org/woo-order-splitter/tags/5.3.9/",
  "https://wordpress.org/plugins/woo-order-splitter/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/woo-order-splitter",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}