EUVD-2026-38686
GHSA-xwgw-9h6v-6mv7
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
C:H chosen because all customer invoice PII across the entire order history is accessible, representing total confidentiality loss for the affected data set; all other metrics match the provided vector.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The WhatsOrder - Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the yapacdev_generate_order_pdf. This makes it possible for unauthenticated attackers to extract sensitive customer PII and order details - including full name, email address, phone number, billing address, ordered items with quantities and prices, applied coupons, shipping method, and order total - from any customer's invoice by enumerating sequential order IDs. Invoice HTML files are written to the publicly accessible wp-content/uploads/whatsorder_invoices/ directory, which is created without an .htaccess deny rule or index.php guard, making every invoice directly downloadable over HTTP with no authentication check.
AnalysisAI
Unauthenticated mass PII harvesting is possible on any WordPress site running the WhatsOrder - Instant Checkout for WooCommerce plugin (all versions through 1.0.1) because the plugin writes customer invoice HTML files to a publicly accessible directory with no access restrictions. The yapacdev_generate_order_pdf function deposits invoices under wp-content/uploads/whatsorder_invoices/ without generating an .htaccess deny rule or index.php guard, and because WooCommerce uses predictable sequential order IDs, any remote attacker can enumerate and download every customer invoice with no authentication. Exposed data includes full name, email, phone number, billing address, itemized order contents with pricing, applied coupon codes, shipping method, and order total. No public exploit code has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog.
Technical ContextAI
WhatsOrder is a PHP-based WordPress plugin (CPE: cpe:2.3:a:yapacdev:whatsorder_-_instant_checkout_for_woocommerce:*:*:*:*:*:*:*:*) designed to streamline WooCommerce checkout flows via WhatsApp-assisted ordering. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), which manifests here through two compounding weaknesses: first, the yapacdev_generate_order_pdf function (visible in the plugin source at L159, L222, L225 in both tag 1.0.0 and 1.0.1) persists invoice data as static HTML files to the WordPress uploads directory rather than generating them dynamically with an authenticated request check; second, the invoices directory is created without any server-level access control (no .htaccess deny rule, no index.php guard). WordPress's wp-content/uploads/ is served directly by the web server and is universally web-accessible by default. Combined with WooCommerce's sequential integer order ID scheme - a well-known design characteristic - this produces a trivially enumerable, zero-auth PII leak across the entire order history of any affected store.
RemediationAI
No vendor-released patched version is confirmed in available data at time of analysis. Store operators should immediately deactivate and remove the WhatsOrder plugin until a patched version is released. As an urgent compensating control, administrators should deny HTTP access to the invoice directory by adding a deny-all .htaccess file at wp-content/uploads/whatsorder_invoices/.htaccess containing deny from all - this blocks direct file retrieval without breaking the plugin's PDF generation logic, though the invoices will remain on disk and accessible via server-side PHP. Additionally, delete all existing invoice files in that directory to remediate already-written PII exposure, as static files persist indefinitely even after plugin removal. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d625d6-57e0-4dc7-b3ee-cb0639a02230 and the plugin's WordPress.org page for a patched release. Review web server access logs for prior enumeration attempts against the whatsorder_invoices/ path to assess whether exploitation has already occurred.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today