EUVD-2026-36806
GHSA-vmh5-x928-7v6f
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L reflects subscriber-role authentication prerequisite; C:H reflects full read access to other users' sensitive order and personal data; I:N and A:N because exploitation yields read-only data exposure with no write or availability impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Sensitive Data Exposure in WPPizza <= 3.19.9 versions.
AnalysisAI
Sensitive subscriber data exposure in the WPPizza WordPress plugin (versions ≤ 3.19.9) permits any authenticated user with a subscriber-level account to access protected data belonging to other users, such as customer order records or personal information managed by the plugin. The vulnerability stems from insufficient access control enforcement on data retrieval functionality (CWE-497), where low-privilege users are permitted to query sensitive system information outside their authorization scope. No public exploit code or confirmed active exploitation has been identified at time of analysis, though the low access complexity makes opportunistic exploitation realistic on sites permitting public user registration.
Technical ContextAI
WPPizza is a WordPress food ordering plugin developed by ollybach (CPE: cpe:2.3:a:ollybach:wppizza:*:*:*:*:*:*:*:*) that manages customer orders, menu items, and subscriber data within the WordPress ecosystem. CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere) identifies the root cause as a failure to restrict access to privileged data from insufficiently privileged callers. In WordPress plugins, this class of flaw typically manifests as missing or improperly enforced capability checks on AJAX action handlers, REST API endpoints, or shortcode callbacks - allowing any authenticated user (even the lowest 'subscriber' role) to trigger data-retrieval operations that should be restricted to administrators or the data owner. The plugin's typical data scope includes customer names, addresses, phone numbers, and order histories, making this category of exposure particularly sensitive under data protection frameworks.
RemediationAI
The primary remediation is to update WPPizza to a version beyond 3.19.9 as soon as a patched release is published; no exact fixed version number is confirmed in the available intelligence, so administrators should monitor the official WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wppizza/vulnerability/wordpress-wppizza-plugin-3-19-9-sensitive-data-exposure-vulnerability for patch confirmation. As an immediate compensating control, disable public user registration on the WordPress site (wp-admin → Settings → General → uncheck 'Anyone can register') to eliminate the low-privilege account acquisition path required for exploitation - this is highly effective but prevents legitimate subscriber self-registration, which may be a business-critical feature for ordering workflows. If open registration must remain enabled, deploy a web application firewall rule to restrict access to WPPizza-specific AJAX endpoints (typically filtered by 'action=wppizza_*' in POST bodies to wp-admin/admin-ajax.php) to authenticated users whose roles match expected customer roles only. Audit existing subscriber accounts for unauthorized access if the plugin has been internet-exposed in its vulnerable state.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today