The vulnerability identified as CVE-2025-49352 affects the YoOhw Studio Order Cancellation & Returns for WooCommerce plugin (versions up to 1.1.11). It arises from improper access control configurations that allow an attacker to bypass authorization checks by manipulating a user-controlled key. This can lead to unauthorized actions within the order cancellation and returns functionality. The CVSS 3.1 base score is 4.3, indicating a medium severity issue with network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, no confidentiality or availability impact, but with integrity impact.

The vulnerability allows an attacker with low privileges to bypass authorization controls and potentially manipulate order cancellation and return processes. This could lead to unauthorized modifications affecting the integrity of order data. There is no reported impact on confidentiality or availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and restrict user privileges related to order cancellation and returns. Monitor for updates from YoOhw Studio regarding patches or official mitigations.