CVE-2026-9612 WhatsOrder <= 1.0.1 - Unauthenticated Sensitive Information Exposure via Predictable Invoice File URLs
Unauthenticated attackers can access sensitive customer PII and order details by enumerating predictable invoice URLs in the WhatsOrder plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9612?
CVE-2026-9612 is a medium-severity vulnerability in yapacdev WhatsOrder – Instant Checkout for WooCommerce, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the yapacdev_generate_order_pdf. This makes it possible for unauthenticated attackers to extract sensitive customer PII and order details — including full name, email address, phone number, billing address, ordered items with quantities and prices, applied coupons, shipping method, and order total — from any customer's invoice by enumerating sequential order IDs. Invoice HTML files are written to the publicly accessible wp-content/uploads/whatsorder_invoices/ directory, which is created without an .htaccess deny rule or index.php guard, making every invoice directly downloadable over HTTP with no authentication check.
Weakness: CWE-200
Which versions are affected by CVE-2026-9612?
How do I fix CVE-2026-9612?
No fix has been published for CVE-2026-9612 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-9612 being exploited?
There is no known exploitation of CVE-2026-9612 in the wild and no public exploit code.
Sources
Also known as GHSA-xwgw-9h6v-6mv7.