Order Splitter for WooCommerce, CVE-2025-12075

CVE, Research URL: CVE-2025-12075
Home page URL: Security reports for Order Splitter for WooCommerce
Application: Order Splitter for WooCommerce
Published on: Feb 18, 2026
Research Description: The Order Splitter for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'wos_troubleshooting' AJAX endpoint in all versions up to, and including, 5.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view information pertaining to other user's orders.
Affected versions: max 5.3.6.
Status: vulnerable