Sensitive Information Exposure in WhatsOrder plugin for WooCommerce by WordPress

CVE-2026-9612

What is CVE-2026-9612?

The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress exposes sensitive customer information, allowing unauthenticated attackers to access personal data through the yapacdev_generate_order_pdf function. This vulnerability enables the extraction of critical customer details such as full names, email addresses, phone numbers, billing addresses, order contents, and total amounts by simply enumerating order IDs sequentially. The invoices are stored in a publicly accessible directory without proper security measures, making them vulnerable to unauthorized downloads via HTTP without any authentication requirement.

References