Bulk-cancelled orders email every customer's address
Bulk-cancelling orders sends one cancellation email to many customers with every recipient's address visible, exposing personal data.
Tier I · Proven The best-established problems.
9 public reports · first reported 24 May 2019 · last reported 1 August 2025
What's going wrong
WooCommerce site owners using this cancelled-order email plugin report that bulk-cancelling orders sends one message to many customers with every recipient's address visible, exposing names, order details and postal addresses. Owners describe emailing customers to apologise after the breach and disabling the plugin entirely. Some reporters shared code patches, and the problem puts shops at risk of privacy and GDPR complaints. A fix would be a safe per-recipient sending layer or a bulk-cancel guard that keeps cancellation emails private.
AI-assisted: written with the help of AI from the reports.
Products affected
Send email to customer on cancelled order in WooCommerce.
Related problems
Who has this problem
3 businesses found.
Unlock them at the top of this page — $57.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.