# Order Splitter for WooCommerce <= 5.3.8 - Missing Authorization to Unauthenticated Order Totals Recalculation, Log Clearing and Test Email Sending

- **ID:** WPSEC-2026-2367
- **Plugin:** Order Splitter for WooCommerce (`woo-order-splitter`), https://wordpress.org/plugins/woo-order-splitter/
- **Affected versions:** all versions before 5.3.9
- **Fixed in:** 5.3.9 (Update to 5.3.9 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/woo-order-splitter
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2367/

## Description

The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data via several debug and maintenance request parameters (get_keys, wc_os_clear_order_log, wc-os-email-testing and wc-os-quick-email-testing) in all versions up to, and including, 5.3.8. This is due to missing capability checks in functions that run on the admin_init hook. This makes it possible for unauthenticated attackers to recalculate the totals of arbitrary orders, clear the plugin's order log and, when the plugin's email log option is on, send test emails to the site administrator.

## References

- https://wpsec.com/vuln/WPSEC-2026-2367/
- https://plugins.svn.wordpress.org/woo-order-splitter/tags/5.3.9/
- https://wordpress.org/plugins/woo-order-splitter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2367/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.