Description
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing customer PII — including names, billing and shipping addresses, email addresses, phone numbers, and order contents — directly over HTTP with no authentication. This is exploitable whenever the .htaccess and index.php guard files are absent from wp-content/webtoffee_export/, which can occur after any uninstall/reinstall cycle, migration, backup restore, or staging sync, since the export directory persists but its guard files do not; export filenames follow a fully deterministic second-precision timestamp pattern, making them brute-forceable across any suspected export window.
Published: 2026-10-10
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Exposure
Action: Apply Patch
AI Analysis

Impact

This vulnerability allows unauthenticated attackers to download order CSV files containing personally identifiable information, such as names, addresses, email addresses, phone numbers, and order contents. It originates from a missing guard file verification in the get_file_path() function, resulting in insufficient file‑access control that can be classified as CWE‑552.

Affected Systems

The plugin Order Export & Order Import for WooCommerce, developed by WebToffee, affects versions 2.7.8 and earlier. The vulnerability can be triggered when the wp-content/webtoffee_export/ directory is missing its .htaccess and index.php guard files, a condition that can arise after uninstall/install cycles, migrations, backup restores, or staging synchronizations.

Risk and Exploitability

The CVSS score is 5.3, indicating a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. However, the exploit can be performed without authentication over HTTP, and the deterministic, second‑precision timestamp filename pattern allows brute‑forcing of exported files, making the unauthorized exposure of sensitive customer data a tangible risk for affected WordPress sites.

Generated by OpenCVE AI on October 10, 2026 at 06:40 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the plugin to the latest available version (2.7.9 or newer) to install the vendor fix.
  • Restore the missing .htaccess and index.php guard files in the wp-content/webtoffee_export/ directory or configure your web server to deny direct HTTP access to that directory.
  • If upgrading is not possible, restrict access to the export directory by adding an .htaccess rule that denies all or applying server configuration to block file downloads, and verify that such protections are in place after any uninstall, reinstall, migration, or backup restore.

Generated by OpenCVE AI on October 10, 2026 at 06:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 10 Oct 2026 05:45:00 +0000

Type Values Removed Values Added
Description The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing customer PII — including names, billing and shipping addresses, email addresses, phone numbers, and order contents — directly over HTTP with no authentication. This is exploitable whenever the .htaccess and index.php guard files are absent from wp-content/webtoffee_export/, which can occur after any uninstall/reinstall cycle, migration, backup restore, or staging sync, since the export directory persists but its guard files do not; export filenames follow a fully deterministic second-precision timestamp pattern, making them brute-forceable across any suspected export window.
Title Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
Weaknesses CWE-552
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-10-11T16:55:17.573Z

Reserved: 2026-09-21T12:26:37.453Z

Link: CVE-2026-94375

cve-icon Vulnrichment

Updated: 2026-10-11T16:45:55.863Z

cve-icon NVD

Status : Deferred

Published: 2026-10-10T06:16:44.857

Modified: 2026-10-13T13:29:12.567

Link: CVE-2026-94375

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-10T06:45:17Z

Weaknesses
  • CWE-552

    Files or Directories Accessible to External Parties