Custom Order Numbers For Woocommerce Vulnerabilities

The Custom Order Numbers for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.11.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS:

5.3

Affected:

up to 1.11.0

Fixed in:

1.11.1

Disclosed:

Nov 22, 2025

CVE-2025-66071 on NVD →

The Custom Order Numbers for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.0. This is due to missing or incorrect nonce validation on the dismiss_notice function. This makes it possible for unauthenticated attackers to dismiss an administrative no...

CVSS:

4.3

Affected:

up to 1.6.0

Fixed in:

1.7.0

Disclosed:

Jan 30, 2024

The Custom Order Numbers for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.4.0. This is due to missing nonce validation on several functions like alg_custom_order_numbers_admin_notice_dismiss, alg_custom_order_numbers_admin_meta_key_notice_dismiss, and...

CVSS:

5.4

Affected:

up to 1.4.0

Fixed in:

1.4.1

Disclosed:

Apr 14, 2023

CVE-2022-45367 on NVD →