Sensitive Information Exposure in WooCommerce Plugin for WordPress
CVE-2023-7320

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
WooCommerce
Vendor
CVE Published:
29 October 2025

What is CVE-2023-7320?

The WooCommerce plugin for WordPress has a flaw due to improper Cross-Origin Resource Sharing (CORS) handling on its Store API's REST endpoints. This vulnerability enables unauthenticated attackers to access sensitive user information, including personal identifiable information (PII), from any origin. The issue affects versions of WooCommerce up to and including 7.8.2, posing a substantial security risk for website owners and users alike.

Affected Version(s)

WooCommerce * <= 7.8.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://wpscan.com/vulnerability/d1cec296-b5df-4cea-8c0d-...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

osama-hamad
JSON
.
CVE-2023-7320 : Sensitive Information Exposure in WooCommerce Plugin for WordPress