CVE-2026-9612: WhatsOrder WooCommerce Plugin Unauthenticated PII Exposure via Publicly Accessible Invoices

Technical summary

CVE-2026-9612 is a Sensitive Information Exposure vulnerability (CWE-200) in WhatsOrder for WooCommerce versions up to 1.0.1. The plugin generates PDF invoices via the yapacdev_generate_order_pdf function and stores them in wp-content/uploads/whatsorder_invoices/ without authentication controls or directory traversal protections. The directory lacks an .htaccess deny rule or index.php gate, allowing direct HTTP access to invoice files. Because order IDs are sequential and predictable, unauthenticated attackers can enumerate invoices systematically to extract customer PII, item details, applied discounts, shipping methods, and order totals.

Business impact

For WooCommerce store operators, this vulnerability poses direct risk to customer trust and regulatory compliance. Exposed PII—names, emails, phone numbers, and addresses—can be harvested for phishing, identity theft, or sale on underground markets. Payment card data may be inferred from order totals and items. Stores face potential liability under GDPR, CCPA, and similar privacy regimes, plus reputational damage and customer notification costs if a breach is discovered. The attack requires no special tools or authentication, making it a low-friction attack vector that may already be exploited.

Affected systems

WordPress sites running the WhatsOrder – Instant Checkout for WooCommerce plugin in versions 1.0.1 and earlier are affected. The vulnerability exists by default in all installations; no additional configuration is required to trigger it. Any WordPress multisite or single-site deployment using this plugin to generate invoices is at risk.

Exploitability

Exploitability is high: the attack requires no authentication, no user interaction, no special tools, and no complex setup. An attacker needs only a web browser to enumerate sequential order IDs and retrieve invoices. The CVSS score of 5.3 (Medium) reflects low confidentiality impact in isolation, but the practical risk is elevated by the ease of exploitation and the sensitivity of the data exposed. This vulnerability is not currently listed in CISA's Known Exploited Vulnerabilities catalog, but the low barrier to exploitation means opportunistic scanning is likely.

Remediation

Immediately update the WhatsOrder plugin to a patched version released by the vendor. Until a patch is confirmed available, site operators should disable the plugin or remove invoice generation functionality. If invoices must remain active, apply manual mitigations: (1) add an .htaccess file to wp-content/uploads/whatsorder_invoices/ containing 'Deny from all' to block HTTP access; (2) move the invoices directory outside the web root; or (3) implement a security plugin that restricts directory access. Review web server logs for evidence of suspicious invoice enumeration (sequential GET requests to whatsorder_invoices/).

Patch guidance

Consult the WhatsOrder plugin vendor's security advisory at their official GitHub repository or WordPress plugin support page for the patched version number and release date. Verify the patch adds authentication checks to the yapacdev_generate_order_pdf function and moves or protects invoice storage outside the public web directory. Test the patch in a staging environment before production deployment to ensure no invoice generation or download regressions. Consider enabling automatic plugin updates if your WordPress security policy permits.

Detection guidance

Monitor web server access logs for repeated or sequential GET requests to files matching wp-content/uploads/whatsorder_invoices/*.pdf or *.html patterns, particularly from non-administrative IP ranges or referrers. Enable WordPress security logging via security plugins (e.g., Wordfence, Sucuri) to flag unauthorized invoice access. Audit the whatsorder_invoices directory for unexpected file counts or access timestamps. Check for suspicious referrer patterns or automated scanning tools in HTTP logs. If your site is compromised, examine invoice directory modification times and compare file counts against order counts to detect potential exfiltration.

Why prioritize this

Although rated CVSS 5.3 (Medium), this vulnerability warrants prompt remediation because: (1) exploitation is trivial and requires no special capabilities; (2) the data exposed is highly sensitive PII with direct regulatory and reputational consequences; (3) the attack is passive and difficult to detect in real time; (4) remediation is straightforward once a patch is released. Organizations using this plugin should treat it as elevated-priority until patched.

Risk score, explained

The CVSS 5.3 score reflects low attack complexity, no privileges required, no user interaction, and confidentiality impact limited to customer order and PII data. The score does not account for the likelihood of the vulnerability being exploited, the ease of weaponization, or the sensitivity of the exposed data in business context. Security teams should treat the practical risk as higher than the base CVSS score suggests, given the ease of exploitation and the consequences of PII exposure.

Frequently asked questions