Authorization Bypass in WooCommerce Plugin by WordPress
CVE-2026-18357
Currently unrated
What is CVE-2026-18357?
The WPC Order Tip for WooCommerce plugin prior to version 3.3.1 is susceptible to an authorization bypass due to the lack of proper nonce verification and authorization checks in its reporting functionality. This oversight permits unauthorized individuals to access sensitive order information for any customer, including billing details, order IDs and statuses, fee amounts, and order dates, potentially leading to data breaches and exploitation.
Affected Version(s)
WPC Order Tip for WooCommerce 0 < 3.3.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.