EUVD-2026-57728
GHSA-4mr5-p2q5-rxpw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Network-accessible IDOR with no auth (PR:N); integrity High for arbitrary order state modification; confidentiality Low as exposure is per-order PII, not bulk database access.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders.
Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled.
AnalysisAI
WP Helper Premium WordPress plugin before 4.7.6 exposes WooCommerce order data to unauthenticated network attackers via a missing order key authorization check on its custom order confirmation page and related AJAX handlers. Any unauthenticated user can enumerate order IDs to read other customers' personally identifiable information and arbitrarily change the state of any order. No public exploit has been identified at time of analysis, though the SSVC framework rates this as automatable, meaning scripted mass enumeration is technically feasible once the vulnerable module is enabled.
Technical ContextAI
CWE-639 (Authorization Bypass Through User-Controlled Key) describes an Insecure Direct Object Reference (IDOR) pattern where a user-controlled identifier - here, a WooCommerce order ID or order key - is accepted without verifying it belongs to the requesting user. WooCommerce generates per-order keys intended as a secondary authorization token for confirmation pages; the WP Helper Premium plugin introduces its own order confirmation page module and AJAX action handlers but omits this key-to-user binding check entirely. This means any HTTP request supplying an arbitrary order identifier is accepted without authentication or ownership validation. The vulnerability exists within the WordPress plugin ecosystem, where WooCommerce provides the e-commerce data layer and WP Helper Premium extends it with supplementary UI. No CPE string was provided in the available intelligence.
RemediationAI
Update WP Helper Premium to version 4.7.6 or later, which introduces proper order key verification on the custom order confirmation page and its AJAX endpoints; patch availability is confirmed by the WPScan advisory at https://wpscan.com/vulnerability/0d43b739-90de-4bae-90c1-3acaee8888e6/. The exact patched version (4.7.6) is derived from the EUVD affected version range rather than an independently reviewed vendor changelog, so verify via the WordPress plugin repository after updating. If patching is not immediately feasible, disable the optional order confirmation page module within WP Helper Premium settings - this removes the vulnerable code path entirely at the cost of losing the custom confirmation page feature. As a secondary compensating control, WAF rules targeting the specific AJAX action parameters exposed by the module can reduce enumeration risk, but require careful tuning to avoid breaking legitimate order confirmation flows for real customers.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today