Doofinder CVE-2026-39542

The CVSS 5.3 (Medium) score reflects a remote, unauthenticated attack requiring low complexity with limited confidentiality impact (C:L) and no integrity or availability impact. However, the EPSS score of 0.02% (5th percentile) signals very low real-world exploitation probability, suggesting this remains a low-priority issue despite the network-accessible attack vector. No KEV status or public exploit code has been confirmed, further reducing immediate threat likelihood. This exemplifies a scenario where CVSS inflation due to unauthenticated remote access is tempered by practical exploit difficulty and minimal observed weaponization. Security teams should prioritize other vulnerabilities, but should patch when convenient as part of routine plugin maintenance.

An attacker sends a normal HTTP request to a WooCommerce site running Doofinder for WooCommerce versions ≤2.10.13 and observes sensitive information (such as API keys, search service credentials, or user identifiers) embedded in the plugin's HTTP responses or frontend JavaScript. With no authentication required and low implementation complexity, the attacker can passively extract these credentials by monitoring network traffic or examining browser developer tools, then use the compromised credentials to escalate attacks against the Doofinder service or integrated systems.