WordPress Plugin Vulnerabilities

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure

Description

The plugin does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.

Proof of Concept

Affects Plugins

Plugin icon
teddy-bear-customize-addon
No known fix

References

CVE
CVE-2026-14562

Classification

Type
SENSITIVE DATA DISCLOSURE
OWASP top 10
A3: Sensitive Data Exposure
CWE
CWE-200
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
0xBassia
Submitter
0xBassia
Submitter website
https://github.com/0xBassia
Submitter twitter
MohamedBassia
Verified
Yes
WPVDB ID
890f55f9-0bd0-4816-a666-a735b41ce5c7

Timeline

Publicly Published
2026-09-09 (about 2 days ago)
Added
2026-09-09 (about 1 day ago)
Last Updated
2026-09-09 (about 1 day ago)

Other

Published
Title
Published
2026-09-02
Title
Xpro Elementor Addons < 1.7.8 - Unauthenticated Draft/Private Product Disclosure via Quick View
Published
2025-12-12
Title
WPGraphQL Smart Cache < 2.0.1 - Unauthenticated Private Content Disclosure
Published
2025-01-03
Title
Post/Page Copying Tool < 2.0.1 - Unauthenticated Sensitive Information Exposure
Published
2025-02-28
Title
Better Messages – Live Chat for WordPress, BuddyPress, PeepSo, Ultimate Member, BuddyBoss < 2.7.0 - Unauthenticated Sensitive Information Exposure Through Unprotected Directory
Published
2026-01-23
Title
MetForm < 4.1.1 - Unauthenticated Form Submission Exposure via Forgeable Cookie Value