Description

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.

Related CPE's

Could not find any relations

References

https://wpscan.com/vulnerability/0037e6ef-5163-4508-9eef-3173a3951fcc/

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0

Secondary
CWE-200

CVSS impact metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

5.3 · Medium

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-08T06:16:47.457Z

26 hours ago

Last modified

2026-10-08T20:51:18.123Z

12 hours ago