WebToffee Order Export EUVD-2026-96098

Exploitable only when the .htaccess and index.php guard files are absent from wp-content/webtoffee_export/, a state that arises after an uninstall/reinstall cycle, site migration, backup restore, or staging sync (the persistent export directory loses its guards). The attacker must also know or brute-force the target export window, since filenames are second-precision timestamps. Limiting factors: default installs that retain the guard files are not vulnerable, and exploitation requires that order exports were actually generated and still reside in the directory. No authentication or user interaction is required once the directory is unprotected.

This is a moderate, conditionally-exploitable confidentiality issue rather than a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated flaw, which sounds serious, but the real-world risk is gated by a specific precondition: the .htaccess and index.php guard files must be absent from wp-content/webtoffee_export/. Note a clear internal inconsistency in the input: the vulnerability is explicitly Sensitive Information Exposure (CWE-552) of customer PII, yet the supplied vector scores C:N/I:L/A:N - confidentiality impact is marked None while the entire described harm is a confidentiality breach. This metric labeling appears wrong and should be verified with Wordfence/NVD; a confidentiality-impact vector (C:L) is more faithful to the description. No EPSS score, KEV listing, or POC was provided, so there is no evidence of active exploitation - no public exploit identified at time of analysis. Overall: a genuine but situational data-exposure bug worth patching promptly on e-commerce sites handling PII, but not a mass-exploitation crisis absent exploitation signals.

An unauthenticated attacker targets a WooCommerce store running this plugin where the export directory's guard files are missing (e.g., after a reinstall, migration, or staging sync). Because exported CSV filenames follow a deterministic second-precision timestamp pattern, the attacker brute-forces filenames across a suspected export window and downloads order CSVs directly over HTTP, harvesting customer names, billing/shipping addresses, emails, phone numbers, and order contents. No public exploit code was provided, but the deterministic naming makes scripted enumeration straightforward.