CVE-2026-18357 Overview
CVE-2026-18357 is an information disclosure vulnerability in the WPC Order Tip for WooCommerce WordPress plugin before version 3.3.1. The plugin fails to perform authorization or nonce checks in one of its reporting features. Unauthenticated attackers can retrieve sensitive order data belonging to any customer of the store. Exposed data includes billing names, order IDs, order statuses, fee amounts, and order dates. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated remote attackers can enumerate confidential WooCommerce customer order records without any user interaction, exposing personally identifiable information (PII) and transaction details.
Affected Products
- WPC Order Tip for WooCommerce WordPress plugin versions prior to 3.3.1
- WordPress installations with the vulnerable plugin activated
- WooCommerce stores exposing the plugin's reporting endpoint
Discovery Timeline
- 2026-08-09 - CVE-2026-18357 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-18357
Vulnerability Analysis
The WPC Order Tip for WooCommerce plugin adds tipping functionality to WooCommerce checkout flows. It also exposes an internal reporting feature that queries order data associated with recorded tips. The reporting endpoint executes without validating the requester's capability or verifying a WordPress nonce. Any anonymous HTTP client can invoke the endpoint and receive structured order data in the response.
The returned dataset includes billing names, order IDs, order statuses, fee amounts, and order dates. Attackers can iterate over the endpoint to enumerate the store's complete order history. The disclosed data supports downstream fraud, targeted phishing against known customers, and competitive intelligence gathering.
Root Cause
The root cause is missing authorization enforcement on a privileged plugin action. The reporting handler does not call current_user_can() to verify administrator capability. It also omits wp_verify_nonce() or check_admin_referer() calls that would confirm the request originated from an authenticated session. The handler treats unauthenticated requests as trusted administrative calls and returns order records directly.
Attack Vector
An attacker sends an unauthenticated HTTP request to the vulnerable reporting endpoint on a target WooCommerce store. No credentials, session cookies, or user interaction are required. The server responds with the queried order data, which the attacker can parse, store, and correlate against public customer information. The attack scales trivially and can be automated against many WordPress sites at once.
No public proof-of-concept exploit code is available at this time. Refer to the WPScan Vulnerability Report for advisory details.
Detection Methods for CVE-2026-18357
Indicators of Compromise
- Repeated unauthenticated requests to admin-ajax.php or plugin-specific REST routes referencing the WPC Order Tip reporting action
- HTTP 200 responses containing JSON with billing, order_id, status, fee, or date fields returned to anonymous clients
- Unusual request volume from a single source IP targeting WooCommerce endpoints without prior session establishment
- Access logs showing sequential enumeration patterns against WordPress AJAX or REST endpoints
Detection Strategies
- Inspect web server access logs for anonymous POST or GET requests to WPC Order Tip plugin actions and correlate with response sizes above baseline
- Deploy web application firewall (WAF) rules that flag unauthenticated invocations of WooCommerce reporting endpoints
- Monitor for outbound data volume spikes from the WordPress host, which may indicate bulk order data extraction
Monitoring Recommendations
- Enable verbose logging on WordPress AJAX and REST API layers to capture caller identity and endpoint names
- Track installed plugin versions across managed WordPress fleets and alert on WPC Order Tip installations below 3.3.1
- Forward WooCommerce and WordPress logs to a centralized SIEM for correlation across sites and identification of enumeration patterns
How to Mitigate CVE-2026-18357
Immediate Actions Required
- Update WPC Order Tip for WooCommerce to version 3.3.1 or later on all affected WordPress sites
- Audit WooCommerce order data for signs of prior unauthorized access, focusing on anomalous read patterns
- Notify affected customers if evidence of order data exfiltration is confirmed, per applicable data-breach obligations
Patch Information
The plugin vendor addressed the vulnerability in WPC Order Tip for WooCommerce version 3.3.1 by adding authorization and nonce validation to the reporting feature. Site administrators should apply the update through the WordPress plugin dashboard or via WP-CLI. Confirm the installed version after update to ensure the patch is active.
Workarounds
- Deactivate and remove the WPC Order Tip plugin until the update to 3.3.1 can be applied
- Restrict access to wp-admin/admin-ajax.php and plugin REST routes at the WAF or reverse-proxy layer for unauthenticated clients
- Apply IP allowlisting to WordPress administrative endpoints where feasible to limit exposure of privileged actions
# Update the plugin using WP-CLI
wp plugin update wpc-order-tip-for-woocommerce --version=3.3.1
# Verify the installed version
wp plugin get wpc-order-tip-for-woocommerce --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
