–Fixed (security): the return / complaint form now asks for the e-mail address used on the order as well as the order number, and the shop checks the two against each other before it shows anything - the same way WooCommerce's own order tracking page does. Until now the order number alone was enough, and order numbers run in sequence, so anyone could walk through them and see what other customers had bought and how long their warranty still runs. The same check now applies when a request is sent.
–Fixed (security): every unsuccessful lookup now gives one and the same answer, whatever went wrong - a wrong e-mail address and an order number that does not exist read exactly alike, so the form no longer reveals which order numbers exist.
–Fixed (security): a return request is now recorded against the e-mail address on the order itself, and only for a product that is really in that order.
–New: a connection that keeps failing the check, or sends many requests in a row, is paused for a few minutes, so nobody can try order numbers one after another or flood your inbox with return requests.
–Fixed: on a block theme (the WordPress default themes since Twenty Twenty-Two) the "Check order" button did nothing at all - the form's script never received its settings. The returns form works on those themes again.
–New: the e-mail address is filled in for a customer who is already logged in, and your own staff can still look up an order without it.
–Fixed: the notification e-mail your shop receives about a new return request is translated again (German, Spanish, French, Italian, Portuguese); since 1.1.15 it had been going out in English.