CVE-2026-9612

Description

The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the yapacdev_generate_order_pdf. This makes it possible for unauthenticated attackers to extract sensitive customer PII and order details — including full name, email address, phone number, billing address, ordered items with quantities and prices, applied coupons, shipping method, and order total — from any customer's invoice by enumerating sequential order IDs. Invoice HTML files are written to the publicly accessible wp-content/uploads/whatsorder_invoices/ directory, which is created without an .htaccess deny rule or index.php guard, making every invoice directly downloadable over HTTP with no authentication check.

PUBLISHED Reserved 2026-05-26 | Published 2026-06-24 | Updated 2026-06-24 | Assigner Wordfence

Problem types

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Product status

Timeline

Credits

Benedictus Jovan finder

References

www.wordfence.com/...-57e0-4dc7-b3ee-cb0639a02230?source=cve

plugins.trac.wordpress.org/...t-checkout-for-woocommerce.php

plugins.trac.wordpress.org/...t-checkout-for-woocommerce.php

plugins.trac.wordpress.org/...t-checkout-for-woocommerce.php

plugins.trac.wordpress.org/...t-checkout-for-woocommerce.php

plugins.trac.wordpress.org/...t-checkout-for-woocommerce.php

plugins.trac.wordpress.org/...t-checkout-for-woocommerce.php

cve.org (CVE-2026-9612)

nvd.nist.gov (CVE-2026-9612)

Download JSON