YoOhw Studio vulnerabilities

Products

• Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification 1
• Order Cancellation & Returns for WooCommerce 1

Latest YoOhw Studio CVEs

Newest publication first

1. CVE-2026-96838 WordPress Blacklist Manager &#8211; WooCommerce Anti-Fraud, Blacklist &amp; Checkout Verification plugin <= 2.3.1 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2026-09-30

   High·CVSS 8.8 EPSS 0.17%

   Unauthenticated Cross Site Request Forgery (CSRF) in Blacklist Manager – WooCommerce Anti-Fraud, Blacklist & Checkout Verification <= 2.3.1 versions.

2. CVE-2025-49352 WordPress Order Cancellation & Returns for WooCommerce plugin <= 1.1.10 - Insecure Direct Object References (IDOR) vulnerability

   Published 2025-12-31

   Medium·CVSS 4.3 EPSS 0.25%

   Authorization Bypass Through User-Controlled Key vulnerability in YoOhw Studio Order Cancellation & Returns for WooCommerce wc-order-cancellation-return allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Order Cancellation & Returns for Woo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.