Teddy Bear Customize Addon CVE-2026-14562

No special conditions are required beyond the plugin being installed and active on a WordPress/WooCommerce site running version 1.0.5 or earlier. Exploitation is fully unauthenticated (PR:N, UI:N per CVSS) and requires only network access to the site. WooCommerce must be active and orders with associated metadata or attachments must exist for the disclosed data to be meaningful. Exploitation is limited by: (1) the plugin's niche footprint reduces the total target universe; (2) the attacker must know or brute-force order IDs, though WooCommerce order IDs are typically sequential integers starting from low values, making enumeration trivial. There is no implied rate limiting, authentication barrier, or non-default configuration requirement.

The CVSS 5.3 base score (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately characterizes this as a low-complexity, network-accessible, unauthenticated information leak with limited confidentiality scope, but the real-world privacy impact may exceed what C:L implies: WooCommerce order metadata can include full customer names, shipping addresses, order contents, and payment references, while uploaded attachments may contain identity documents, artwork proofs, or other sensitive personal files. No KEV listing is present, so confirmed mass active exploitation is not established. A publicly available WPScan proof-of-concept lowers the practical exploitation barrier to any HTTP client. EPSS data is absent from the input; the niche nature of this plugin limits the absolute blast radius compared to a flaw in a widely deployed component, but any operator running WooCommerce stores with this plugin installed should treat removal as urgent given the near-zero exploitation effort required. The companion RCE in CVE-2026-14560 on the same plugin compounds the case for immediate action.

An attacker sends unauthenticated HTTP requests to the plugin's order-data or attachment endpoints, iterating through sequential WooCommerce order IDs to enumerate order metadata and customer-uploaded file URLs. Because no ownership check or session validation is performed, the attacker harvests customer names, shipping addresses, order contents, and direct download links to uploaded attachments across the entire order history. The publicly available WPScan proof-of-concept automates this enumeration with no credentials or special network position required.