CVE-2026-9612— Yapacdev WhatsOrder 信息泄露漏洞

WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs

The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the yapacdev_generate_order_pdf. This makes it possible for unauthenticated attackers to extract sensitive customer PII and order details — including full name, email address, phone number, billing address, ordered items with quantities and prices, applied coupons, shipping method, and order total — from any customer's invoice by enumerating sequential order IDs. Invoice HTML files are written to the publicly accessible wp-content/uploads/whatsorder_invoices/ directory, which is created without an .htaccess deny rule or index.php guard, making every invoice directly downloadable over HTTP with no authentication check.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

信息暴露

Yapacdev WhatsOrder 信息泄露漏洞

Yapacdev WhatsOrder是摩洛哥Yapacdev团队的一款WooCommerce即时结账插件。 Yapacdev WhatsOrder 1.0.1及之前版本存在信息泄露漏洞，该漏洞源于通过yapacdev_generate_order_pdf函数暴露敏感信息，可能导致未经身份验证的攻击者通过枚举顺序订单ID提取客户个人信息和订单详情，包括全名、邮箱地址、电话号码、账单地址、订购商品及价格、优惠券、配送方式和订单总额。

N/A

N/A