Whatsorder – Instant Checkout For Woocommerce
Approved changes feed: RSS · Atom
cpe:2.3:a:yapacdev:whatsorder_–_instant_checkout_for_woocommerce:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Yapacdev (dfce9e54-6b2c-554a-b752-64109ce92998) |
|---|---|
| Product | Whatsorder – Instant Checkout For Woocommerce (5093d9ac-c967-52d3-ad29-4fde6b9a445f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-9612 |
vulnerable | 2026-07-29 01:12:09.388298 |
WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs
MEDIUM (5.3)
The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the yapacdev_generate_order_pdf. This makes it possible for unauthenticated attackers to extract sensitive customer PII and order details — including full name, email address, phone number, billing address, ordered items with quantities and prices, applied coupons, shipping method, and order total — from any customer's invoice by enumerating sequential order IDs. Invoice HTML files are written to the publicly accessible wp-content/uploads/whatsorder_invoices/ directory, which is created without an .htaccess deny rule or index.php guard, making every invoice directly downloadable over HTTP with no authentication check.
Published: 2026-06-24T05:33:32.351Z
Updated: 2026-06-24T12:19:28.494Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.