WordPress Plugin Vulnerabilities

Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter

Description

The plugin does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.

Proof of Concept

Affects Plugins

Plugin icon
track-orders-for-woocommerce
Fixed in 1.2.7

References

CVE
CVE-2026-94275

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Pedro Pinho
Submitter
Pedro Pinho
Verified
Yes
WPVDB ID
0037e6ef-5163-4508-9eef-3173a3951fcc

Timeline

Publicly Published
2026-10-06 (about 2 days ago)
Added
2026-10-06 (about 1 day ago)
Last Updated
2026-10-06 (about 1 day ago)

Other

Published
Title
Published
2024-04-22
Title
HT Mega – Absolute Addons For Elementor < 2.4.8 - Missing Authorization to Information Exposure
Published
2024-04-25
Title
WP STAGING <= 3.4.3 and WP STAGING Pro <= 5.4.3 - Sensitive Information Exposure via Log File
Published
2026-06-15
Title
GetGenie – AI Content Writer with Keyword Research & SEO Tracking < 4.4.2 - Unauthenticated Information Exposure
Published
2024-10-21
Title
News Kit Elementor Addons < 1.2.2 - Authenticated (Contributor+) Sensitive Information Exposure via Canvas Menu Elementor Template
Published
2023-11-30
Title
Backup Migration < 1.3.7 - Unauthenticated Arbitrary File Download to Sensitive Information Exposure