CVE-2026-19073 Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Order Data Disclosure
Unauthenticated attackers can retrieve customer order history and purchase totals via an unprotected REST API endpoint in the Order Sync with Zendesk plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-19073?
CVE-2026-19073 is a medium-severity missing authorization vulnerability in Unknown Order Sync with Zendesk for WooCommerce, published on 12 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.
Weakness: CWE-200
Which versions are affected by CVE-2026-19073?
How do I fix CVE-2026-19073?
No fix has been published for CVE-2026-19073 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-19073 being exploited?
There is no known exploitation of CVE-2026-19073 in the wild and no public exploit code.
Sources
Also known as GHSA-75cj-4j6f-h35h.