Sensitive Data Exposure in Doofinder Plugin for WooCommerce by Doofinder
CVE-2026-39542

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Doofinder For WooCommerce
Vendor
CVE Published:
8 April 2026

What is CVE-2026-39542?

The Doofinder for WooCommerce plugin suffers from a vulnerability that allows sensitive data to be embedded in sent responses. Specifically, this issue enables unauthorized retrieval of embedded sensitive information, posing risks to user privacy and data security. This vulnerability impacts versions of the plugin up to and including 2.10.13, necessitating users to act swiftly to protect their sensitive information from potential exposure.

Affected Version(s)

Doofinder for WooCommerce 0 <= 2.10.13

References

https://patchstack.com/database/Wordpress/Plugin/doofinde...
vdb-entry

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Que Thanh Tuan | Patchstack Bug Bounty Program
.