Doofinder for WooCommerce EUVD-2026-116770

The plugin stores sensitive information in a file or directory reachable over the network, which an unauthenticated remote attacker can retrieve (AV:N/AC:L/PR:N/UI:N). The available sources do not name the specific file, URL, feature, or configuration that exposes the data, so the exact trigger is not described in the available sources. Limiting factors: impact is confidentiality-only (C:H, I:N, A:N) - no write, modification, or denial-of-service capability - and exposure is bounded to installations running Doofinder for WooCommerce versions up to and including 2.17.2.

Signals are moderate and partially incomplete. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N, 7.5) describes a network-reachable, low-complexity, unauthenticated read of high-impact confidential data with no integrity or availability effect - a classic information-disclosure profile, not code execution. The vuln.today decision label is 'this_week' (elevated but below act_now/emergency), and the finding is attributed to Patchstack, a credible WordPress-security source. However, several decision signals are MISSING: no EPSS probability is provided, there is no CISA KEV listing, and no verified public exploit code is supplied - the single reference is a Patchstack advisory/database entry, not a PoC. CWE-538 (sensitive info in an externally-accessible file) is consistent with the unauthenticated-read vector, so the signals do not conflict; they simply point to a real but not critical issue. The main limiter is that the description is generic ('Retrieve Embedded Sensitive Data') and does not name the exact file, endpoint, or data exposed, so blast radius cannot be precisely bounded from the available data. Net: a genuine confidentiality exposure worth patching promptly given unauthenticated remote reach, but with no evidence of active or widespread exploitation to date.

An unauthenticated remote attacker requests an externally-accessible file or directory served by the Doofinder for WooCommerce plugin and reads embedded sensitive data (such as configuration or credential material) directly over HTTP. No authentication, user interaction, or special timing is required per the CVSS vector. No verified public exploit code is provided; the only reference is a Patchstack advisory.