Doofinder For Woocommerce
Monthly
Doofinder for WooCommerce through 2.17.2 stores sensitive information in a file or directory that is reachable over the network, allowing an unauthenticated remote attacker to retrieve it (CVSS 3.1: 7.5, confidentiality-only). The available sources do not identify the specific exposed file, URL, or plugin feature, and no public exploit code or active exploitation is confirmed at time of analysis.
Doofinder for WooCommerce through version 2.10.13 discloses sensitive information by inserting it into sent data, allowing remote unauthenticated attackers to retrieve embedded secrets with low attack complexity. The vulnerability affects all installations of the plugin and has been reported by Patchstack, with EPSS exploitation probability at 0.02% (low real-world risk), though no KEV status or public exploit code has been identified.
Doofinder for WooCommerce through 2.17.2 stores sensitive information in a file or directory that is reachable over the network, allowing an unauthenticated remote attacker to retrieve it (CVSS 3.1: 7.5, confidentiality-only). The available sources do not identify the specific exposed file, URL, or plugin feature, and no public exploit code or active exploitation is confirmed at time of analysis.
Doofinder for WooCommerce through version 2.10.13 discloses sensitive information by inserting it into sent data, allowing remote unauthenticated attackers to retrieve embedded secrets with low attack complexity. The vulnerability affects all installations of the plugin and has been reported by Patchstack, with EPSS exploitation probability at 0.02% (low real-world risk), though no KEV status or public exploit code has been identified.