CVE-2026-9612: Unauthenticated Sensitive Info Exposure in WhatsOrder Plugin

Vulnerability Overview Vulnerability Name: WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs CVE ID: CVE-2026-9612 CVSS Score: 5.3 (Medium) Publish Date: June 23, 2026 Last Updated: June 24, 2026 Researchers: Benedictus Jovan (all3m3) Affected Range Affected Software: WhatsOrder - Instant Checkout for WooCommerce Software Type: Plugin Software Slug: whatsorder-instant-checkout-for-woocommerce Fixed: No Affected Versions: <= 1.0.1 Remediation Known Patches: No known patches are available. Recommended Actions: Please review the vulnerability details in detail and take mitigation measures based on your organization's risk tolerance. It may be necessary to uninstall the affected software and seek alternatives. Vulnerability Description The WhatsOrder - Instant Checkout for WooCommerce plugin, in version 1.0.1 and earlier, contains a sensitive information exposure vulnerability. Attackers can extract customers' Personally Identifiable Information (including full name, email address, phone number, billing address, ordered items along with their quantities and prices, applied coupons, shipping method, and order total) by enumerating order IDs from any customer's invoice. The invoice HTML files are written to the publicly accessible directory, which lacks deny rules or guards, allowing each invoice to be downloaded directly via HTTP without authentication. References plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT, and 2pm-1am UTC/GMT (excluding weekends and holidays) Response Time: 24/7 support with a 1-hour response time Copyright Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Disclaimer Disclaimer: This record contains copyrighted material. Contact Contact Email: api-support@wordfence.com Other Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Social Media Links Twitter: Twitter Facebook: Facebook YouTube: YouTube Instagram: Instagram Product Links Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Support Links Support: - Documentation - Learning Center - Free Support - Premium Support News Links News: - Blog - In The News - Vulnerability Advisories About Links About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Subscription Links Stay Updated: - Sign up for news and updates from our panel of experienced security professionals. - By checking this box I agree to the terms of service and privacy policy. Subscription Button SIGN UP Footer Links © 2012-2026 Defiant Inc. All Rights Reserved Footer Icons Defiant Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Footer Links Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Footer Links Support: - Documentation - Learning Center - Free Support - Premium Support Footer Links News: - Blog - In The News - Vulnerability Advisories Footer Links About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Footer Links Stay Updated: - Sign up for news and updates from our panel of experienced security professionals. - By checking this box I agree to the terms of service and privacy policy. Footer Links SIGN UP Footer Links © 2012-2026 Defiant Inc. All Rights Reserved Footer Links Defiant Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice at Collection Do Not Sell or Share My Personal Information: Do Not Sell or Share My Personal Information Footer Links Products: - Wordfence Free - Wordfence Premium - Wordfence Care - Wordfence Response - Wordfence CLI - Wordfence Intelligence - Wordfence Central Footer Links Support: - Documentation - Learning Center - Free Support - Premium Support Footer Links News: - Blog - In The News - Vulnerability Advisories Footer Links About: - About Wordfence - Affiliate Program - Employment - Contact - Security - CVE Request Form Footer Links Stay Updated: - Sign up for news and updates from our panel of experienced security professionals. - By checking this box I agree to the terms of service and privacy policy. Footer Links SIGN UP Footer Links © 2012-2026 Defiant Inc. All Rights Reserved Footer Links Defiant Footer Links Terms of Service: Terms of Service Privacy Policy and Notice at Collection: Privacy Policy and Notice

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-9612: Unauthenticated Sensitive Info Exposure in WhatsOrder Plugin

More from this source