WPZOOM Connect CVE-2026-100149

Requires: (1) WPZOOM Connect ≤4.7.3 active with a live Yamidoo AI chat connection; (2) WooCommerce and/or Easy Digital Downloads (with EDD Software Licensing for license-key exposure) present with real customer data; (3) the share_customer_data and identify_logged_in settings enabled - both are ON by default, so NO non-default configuration is needed; and (4) the ability to register a WooCommerce customer or subscriber-level account whose email local part encodes the target timestamp and victim email so the inline_js()-printed signature passes verify_request(). Limiting factors: the attacker must be able to create an account (open registration), must correctly craft the encoding email, and the disclosed data is bounded to the chat customer-card fields (though for any arbitrary victim email on the site).

Signals are mixed and point to a genuine but mid-tier priority. The CVSS base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable, low-complexity, and nominally unauthenticated with only a limited confidentiality impact and no integrity/availability effect. No EPSS probability, no CISA KEV listing, and no public exploit code were supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. However, two input signals conflict with the raw score and should temper reliance on it. First, the CVSS vector claims PR:N (unauthenticated), but the description explicitly requires the attacker to register a WooCommerce customer or subscriber-level account with a crafted email - in practice this is a low-privilege (PR:L) precondition, trivially met only where self-registration is open. Second, C:L understates the actual exposure: the flaw yields the full customer card - name, WordPress user ID, order history/totals, purchased products, payment-method labels, and EDD Software Licensing keys with activation counts - for ANY arbitrary victim email on the site, which is a serious confidentiality impact for e-commerce/licensing stores. Because the vulnerable features (share_customer_data and identify_logged_in) are enabled by default, affected sites are exposed without any special configuration. Net: a real, broadly-reachable PII and license-key disclosure that merits prompt patching for WooCommerce/EDD stores, but without current exploitation evidence it is not an emergency on the level of a KEV-listed RCE.

An attacker self-registers a WooCommerce customer or subscriber account on a store running WPZOOM Connect ≤4.7.3, using an email whose local part encodes a chosen timestamp and the victim's email address. They load a front-end page where inline_js() prints an x-yamidoo-signature into the HTML, harvest that signature, and replay it against verify_request() so it validates for the victim rather than themselves - returning the victim's complete customer card including PII, order history, and EDD license keys. No public exploit code has been identified, but the technique is deterministic and requires no special timing.