EUVD-2026-57107
GHSA-75cj-4j6f-h35h
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible unauthenticated read-only endpoint; only partial confidentiality (customer order records) with no integrity or availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.
AnalysisAI
Unauthenticated information disclosure in the Order Sync with Zendesk for WooCommerce WordPress plugin (all versions before 2.2.3) exposes full customer order history and cumulative purchase totals to any remote attacker who supplies a target's email address. The plugin's REST API endpoint omits both a WordPress capability check and any ownership verification, meaning the access control layer is entirely absent - not misconfigured but simply missing. A publicly available proof-of-concept exists (reported by WPScan), and SSVC assesses the vulnerability as automatable, making bulk enumeration of customer purchase data a realistic threat; however, no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Technical ContextAI
The affected component is a WordPress plugin that synchronizes WooCommerce order data with Zendesk. WordPress REST API endpoints must register permission callbacks to enforce capability checks; the plugin registers at least one endpoint without such a callback and without validating that the authenticated (or unauthenticated) requester is the account owner. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) is the root cause class - the vulnerability is not an injection or memory-safety issue but a missing access control gate on a data-retrieval API route. CPE cpe:2.3:a:unknown:order_sync_with_zendesk_for_woocommerce:*:*:*:*:*:*:*:* confirms all released versions up to but not including 2.2.3 are affected. WooCommerce order records typically include purchase item details, totals, and transaction metadata, making this exposure meaningful for customer privacy and competitive intelligence.
RemediationAI
Update the Order Sync with Zendesk for WooCommerce plugin to version 2.2.3 or later via the WordPress admin dashboard or WP-CLI (wp plugin update). This is a vendor-released patch confirmed by WPScan and referenced at https://wpscan.com/vulnerability/8c8ca8ff-e0e8-4e9c-b79b-7f95816a9113/. If an immediate upgrade is not possible, a targeted workaround is to block access to the affected REST API route at the web server or WAF layer - identify the specific endpoint path (inspect plugin source or WPScan disclosure for the exact route) and deny unauthenticated requests to it; this prevents exploitation but may break legitimate Zendesk sync functionality. Restricting the WordPress REST API to authenticated users globally (via a must-use plugin or security plugin) is a broader mitigating control but carries the trade-off of breaking other plugins or themes that legitimately serve unauthenticated REST responses. No patch version other than 2.2.3 has been independently identified as safe.
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today