Email Templates Customizer And Designer For Wordpress And Woocommerce
Monthly
Unauthenticated attackers can read every WooCommerce customer's billing data through the Email Templates Customizer and Designer plugin (all versions up to and including 1.5.14) because its preview handler never checks whether the requester is authorized. Two unauthenticated requests suffice: one harvests a reusable nonce from the 302 Location header of an unguarded admin_init handler, and the second passes that nonce with an arbitrary order ID to the preview_order endpoint, returning billing name, address, phone and email; sites with many stored orders expose proportionally more PII. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, CWE-862) and is a priority for this week; no public exploit code or CISA KEV entry was reported in the available data.
Unauthenticated attackers can read every WooCommerce customer's billing data through the Email Templates Customizer and Designer plugin (all versions up to and including 1.5.14) because its preview handler never checks whether the requester is authorized. Two unauthenticated requests suffice: one harvests a reusable nonce from the 302 Location header of an unguarded admin_init handler, and the second passes that nonce with an arbitrary order ID to the preview_order endpoint, returning billing name, address, phone and email; sites with many stored orders expose proportionally more PII. The issue is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:N, CWE-862) and is a priority for this week; no public exploit code or CISA KEV entry was reported in the available data.