Sensitive Information Exposure in Paystack WooCommerce Plugin for WordPress

CVE-2026-93370

What is CVE-2026-93370?

The Paystack WooCommerce Payment Gateway plugin for WordPress is susceptible to sensitive information exposure across all versions up to and including 5.8.5 due to insecure handling of the 'key' parameter. Attackers, without authentication, could exploit this flaw to retrieve sensitive customer data, including billing names, email addresses, phone numbers, billing and shipping addresses, along with product lists. This vulnerability arises particularly when merchants enable the optional custom metadata feature in the Paystack settings, facilitating the extraction of this information by leveraging sequential order IDs embedded in the page HTML via wp_localize_script.

References