WC Cancel Order Security & Risk Analysis

wordpress.org/plugins/wc-cancel-order

Add order cancellation request functionality to your woocommerce powered store.

5K active installs v3.5.1 PHP 7.4+ WP 6.7+ Updated Oct 30, 2025
cancel-orderwoocommerce-cancel-order
100
A · Safe
CVEs total0
Unpatched0
Last CVENever
Safety Verdict

Is WC Cancel Order Safe to Use in 2026?

Generally Safe

Score 100/100

WC Cancel Order has no known CVEs and is actively maintained. It's a solid choice for most WordPress installations.

No known CVEs Updated 5mo ago
Risk Assessment

The "wc-cancel-order" plugin v3.5.1 demonstrates a generally good security posture with a focus on input validation and secure coding practices. The absence of known CVEs and the presence of nonce and capability checks on its entry points are positive indicators. However, the static analysis reveals specific areas of concern that warrant attention. The taint analysis highlights three flows with unsanitized paths, which, despite being categorized as non-critical, represent a potential risk for data manipulation or unintended behavior if exploited.

Key Concerns

  • Taint flows with unsanitized paths (High severity)
  • SQL queries with prepared statements at 57%
  • Output escaping at 61%
Vulnerabilities
None known

WC Cancel Order Security Vulnerabilities

No known vulnerabilities — this is a good sign.
Code Analysis
Analyzed Mar 16, 2026

WC Cancel Order Code Analysis

Dangerous Functions
0
Raw SQL Queries
6
8 prepared
Unescaped Output
24
38 escaped
Nonce Checks
2
Capability Checks
1
File Operations
0
External Requests
0
Bundled Libraries
0

SQL Query Safety

57% prepared14 total queries

Output Escaping

61% escaped62 total outputs
Data Flows
3 unsanitized

Data Flow Analysis

3 flows3 with unsanitized paths
wc_cancel_request (wc-cancel-order.php:400)
Source (user input) Sink (dangerous op) Sanitizer Transform Unsanitized Sanitized
Attack Surface

WC Cancel Order Attack Surface

Entry Points4
Unprotected0

AJAX Handlers 3

authwp_ajax_wc_cancel_requestwc-cancel-order.php:61
noprivwp_ajax_wc_cancel_requestwc-cancel-order.php:62
authwp_ajax_wc-cancel-requestwc-cancel-order.php:63

Shortcodes 1

[wc_cancel_order_details] wc-cancel-order.php:75
WordPress Hooks 24
actionwoocommerce_after_order_detailsclasses\class-wc-cancel-order-details.php:17
filterwoocommerce_settings_tabs_arrayincludes\settings.php:13
actionwoocommerce_settings_tabs_wc_cancel_settingsincludes\settings.php:14
actionwoocommerce_update_options_wc_cancel_settingsincludes\settings.php:15
actioninitwc-cancel-order.php:48
actionwoocommerce_loadedwc-cancel-order.php:50
actionwoocommerce_admin_field_wc_cancel_settingwc-cancel-order.php:51
actionadmin_enqueue_scriptswc-cancel-order.php:52
filterwoocommerce_screen_idswc-cancel-order.php:53
actionwoocommerce_update_optionswc-cancel-order.php:54
filterwoocommerce_my_account_my_orders_actionswc-cancel-order.php:56
actionwp_enqueue_scriptswc-cancel-order.php:58
actionwp_enqueue_scriptswc-cancel-order.php:59
actioninitwc-cancel-order.php:65
filterwc_order_statuseswc-cancel-order.php:66
actionadmin_menuwc-cancel-order.php:67
filterwoocommerce_email_classeswc-cancel-order.php:68
actionwoocommerce_email_wc_cancel_reasonwc-cancel-order.php:69
actionwoocommerce_order_status_changedwc-cancel-order.php:70
actionwoocommerce_checkout_update_order_metawc-cancel-order.php:71
actionwoocommerce_store_api_checkout_order_processedwc-cancel-order.php:72
filterthe_postswc-cancel-order.php:74
actionwoocommerce_email_customer_detailswc-cancel-order.php:76
actionbefore_woocommerce_initwc-cancel-order.php:77
Maintenance & Trust

WC Cancel Order Maintenance & Trust

Maintenance Signals

WordPress version tested6.8.5
Last updatedOct 30, 2025
PHP min version7.4
Downloads132K

Community Trust

Rating98/100
Number of ratings23
Active installs5K
Developer Profile

WC Cancel Order Developer Profile

WpExperts Hub

5 plugins · 7K total installs

90
trust score
Avg Security Score
94/100
Avg Patch Time
15 days
View full developer profile
Detection Fingerprints

How We Detect WC Cancel Order

Patterns used to identify this plugin on WordPress sites during automated security audits and web crawling.

Asset Fingerprints

Asset Paths
/wp-content/plugins/wc-cancel-order/assets/css/cancel-order.css/wp-content/plugins/wc-cancel-order/assets/js/cancel-order.js/wp-content/plugins/wc-cancel-order/assets/js/wco-cancel-admin-script.js/wp-content/plugins/wc-cancel-order/assets/js/wco-cancel-front-script.js
Script Paths
/wp-content/plugins/wc-cancel-order/assets/js/cancel-order.js/wp-content/plugins/wc-cancel-order/assets/js/wco-cancel-admin-script.js/wp-content/plugins/wc-cancel-order/assets/js/wco-cancel-front-script.js
Version Parameters
wc-cancel-order/assets/css/cancel-order.css?ver=wc-cancel-order/assets/js/cancel-order.js?ver=wc-cancel-order/assets/js/wco-cancel-admin-script.js?ver=wc-cancel-order/assets/js/wco-cancel-front-script.js?ver=

HTML / DOM Fingerprints

CSS Classes
wc-cancel-order-details-wrapwc-cancel-order-detailswc-cancel-order-button
HTML Comments
<!-- WC Cancel Order Pro version can be bought from https://wpexpertshub.com/ --><!-- WC Cancel Order Pro version can be bought from https://wpexpertshub.com/ --><!-- This is the custom CSS --><!-- WC Cancel Order Pro version can be bought from https://wpexpertshub.com/ -->+2 more
Data Attributes
data-order-iddata-cancel-request-nonce
JS Globals
wcCancelOrderAJAX
REST Endpoints
/wp-json/wc-cancel-order/v1/request/wp-json/wc-cancel-order/v1/guest-request
Shortcode Output
[wc_cancel_order_details]
FAQ

Frequently Asked Questions about WC Cancel Order