CVE-2025-49352: Yoohw Studio Order Cancellation & Returns For Woocommerce

Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days.

Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for WooCommerce: from n/a through <= 1.1.11.

Affected products

• Yoohw Studio Order Cancellation & Returns For Woocommerce: up to and including 1.1.11

Published 2025-12-31. Last modified 2026-09-23.