CVE-2026-19073: WooCommerce Zendesk Plugin Info Leak Flaw

CVE-2026-19073 Overview

CVE-2026-19073 affects the Order Sync with Zendesk for WooCommerce WordPress plugin in versions prior to 2.2.3. The plugin exposes a REST API endpoint without capability checks or ownership verification. Unauthenticated attackers can query the endpoint using a customer email address to retrieve that customer's order history and purchase totals. Exploitation requires only knowledge or enumeration of a target email address. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Any unauthenticated attacker on the internet can retrieve WooCommerce customer order history and purchase totals for any known or enumerable email address.

Affected Products

Order Sync with Zendesk for WooCommerce WordPress plugin versions prior to 2.2.3
WordPress sites running WooCommerce with the affected plugin enabled
Customer records (order history, purchase totals) stored in WooCommerce

Discovery Timeline

2026-08-12 - CVE-2026-19073 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19073

Vulnerability Analysis

The vulnerability resides in one of the REST API endpoints registered by the Order Sync with Zendesk for WooCommerce plugin. The endpoint accepts a customer email address as input and returns order history and purchase totals for the matching account. The plugin does not enforce a WordPress capability check on the request. It also does not verify that the requester owns or is otherwise authorized to view the queried account.

Because the endpoint is reachable without authentication, any remote actor can issue requests directly. An attacker who knows a customer email address can pull that customer's WooCommerce transaction history. Attackers can also enumerate email addresses through leaked breach data, user directories, or predictable patterns to broaden the disclosure. Retrieved data includes purchase totals, which reveals customer spending behavior useful for phishing, extortion, or competitive intelligence.

Root Cause

The root cause is a missing authorization check on a REST API route registered by the plugin. WordPress REST endpoints must implement a permission_callback that validates both capability and resource ownership. In affected versions, the plugin either returns true from this callback or omits ownership verification entirely, treating an email parameter as a sufficient identifier for the record.

Attack Vector

The attack vector is network-based and requires no authentication, no user interaction, and no elevated privileges. An attacker sends a crafted HTTP request to the plugin's REST endpoint with a target email address as a query parameter. The server responds with the associated order history and purchase totals. Attackers can automate the request against email lists to exfiltrate data at scale.

Refer to the WPScan Vulnerability Report for additional technical detail on the vulnerable endpoint.

Detection Methods for CVE-2026-19073

Indicators of Compromise

Unauthenticated GET or POST requests to /wp-json/ routes registered by the Order Sync with Zendesk for WooCommerce plugin.
Repeated REST API requests from a single source containing varying email parameters, indicating enumeration.
Anomalous outbound response sizes from WordPress hosts correlated with plugin REST endpoints.

Detection Strategies

Review WordPress and web server access logs for requests to plugin-registered REST routes with email= parameters from unauthenticated sessions.
Correlate high-volume REST API access patterns against a baseline of legitimate plugin usage.
Deploy WAF rules that flag unauthenticated requests to WooCommerce-adjacent REST endpoints returning customer data.

Monitoring Recommendations

Enable verbose logging on WordPress REST API endpoints, including source IP, user agent, and query parameters.
Alert on bursts of 4xx or 2xx responses tied to email-parameterized REST calls.
Monitor for reconnaissance patterns targeting /wp-json/ namespaces belonging to WooCommerce plugins.

How to Mitigate CVE-2026-19073

Immediate Actions Required

Upgrade the Order Sync with Zendesk for WooCommerce plugin to version 2.2.3 or later on all WordPress installations.
Audit REST API access logs for prior exploitation attempts against the affected endpoint.
Notify customers if evidence indicates their order history was accessed by unauthorized parties.

Patch Information

The vendor addressed the issue in version 2.2.3 of the Order Sync with Zendesk for WooCommerce plugin. The fix introduces a proper permission_callback that enforces capability checks and ownership verification on the affected REST endpoint. See the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the Order Sync with Zendesk for WooCommerce plugin until the patched version is installed.
Restrict access to /wp-json/ REST API routes at the WAF or reverse proxy layer, permitting only authenticated sessions.
Block direct external access to plugin-registered REST namespaces via HTTP authentication or IP allowlists.

bash

# Example nginx rule to require authentication for the plugin REST namespace
location ~* ^/wp-json/order-sync-zendesk/ {
    auth_basic "Restricted";
    auth_basic_user_file /etc/nginx/.htpasswd;
}