CVE-2026-27374: WooCommerce Order Details Auth Bypass

CVE-2026-27374 Overview

CVE-2026-27374 is a missing authorization vulnerability in the vanquish WooCommerce Order Details plugin for WordPress. The flaw affects all plugin versions up to and including 3.1. Attackers can exploit incorrectly configured access control security levels to interact with plugin functionality reserved for privileged users.

The vulnerability is classified under [CWE-862] (Missing Authorization) and is exploitable over the network without authentication or user interaction. Successful exploitation results in unauthorized access to order-related data handled by the plugin.

Critical Impact
Unauthenticated remote attackers can bypass access control checks in the WooCommerce Order Details plugin to read sensitive order information from affected WordPress stores.

Affected Products

vanquish WooCommerce Order Details plugin (woocommerce-order-details)
All versions from n/a through 3.1
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2026-03-05 - CVE-2026-27374 published to NVD
2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-27374

Vulnerability Analysis

The vulnerability stems from missing authorization checks within the WooCommerce Order Details plugin. The plugin exposes functionality that should be restricted to authorized users, but fails to validate the requester's permissions before processing requests.

An unauthenticated attacker can send crafted HTTP requests to plugin endpoints and receive responses containing data that should require valid authentication. The confidentiality impact is high, while integrity and availability are not affected, indicating the issue centers on unauthorized information access rather than data modification.

The attack complexity is low and requires no user interaction, making opportunistic exploitation straightforward once a vulnerable site is identified. Public scanning of WordPress plugin paths typically reveals installations of this plugin.

Root Cause

The plugin's request handlers do not enforce capability or nonce checks before executing privileged operations. WordPress provides functions such as current_user_can() and check_ajax_referer() to validate authorization, but the affected code paths in versions through 3.1 omit these controls.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker identifies a WordPress site running the vulnerable plugin, then issues HTTP requests directly to plugin endpoints. Because the plugin does not verify user permissions, the server processes the request and returns order details that should be access-restricted.

No verified public proof-of-concept code is available at the time of writing. Technical details are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2026-27374

Indicators of Compromise

Unauthenticated HTTP requests to woocommerce-order-details plugin endpoints from unfamiliar IP addresses
Anomalous spikes in admin-ajax.php requests referencing order-related actions
Outbound responses containing order data delivered to unauthenticated sessions
Repeated enumeration patterns against /wp-content/plugins/woocommerce-order-details/ paths

Detection Strategies

Inventory all WordPress installations and identify sites running the vanquish WooCommerce Order Details plugin at version 3.1 or earlier
Review web server access logs for requests to plugin endpoints lacking valid authentication cookies
Deploy web application firewall (WAF) rules that flag direct access to plugin AJAX or REST endpoints from unauthenticated sources
Correlate plugin requests with WooCommerce order access events to identify mismatches

Monitoring Recommendations

Enable verbose logging on the WordPress site, including request URIs, query strings, and authentication state
Forward web server logs to a centralized SIEM for retention and correlation against plugin-specific patterns
Alert on bursts of requests targeting plugin paths from a single source IP
Monitor for changes to plugin files and unexpected administrative activity on the WordPress backend

How to Mitigate CVE-2026-27374

Immediate Actions Required

Identify all WordPress sites running the WooCommerce Order Details plugin and confirm the installed version
Update the plugin to a fixed version once the vendor publishes one, per the Patchstack advisory
Restrict public access to plugin endpoints at the WAF or reverse proxy layer until a patch is applied
Audit recent web server logs for evidence of unauthorized access to order data

Patch Information

No fixed version is referenced in the published CVE record at the time of writing. Versions up to and including 3.1 are affected. Review the Patchstack Vulnerability Report for the latest remediation guidance and any newly released plugin versions.

Workarounds

Deactivate and remove the WooCommerce Order Details plugin until a fixed version is available
Apply WAF rules that require authenticated sessions for requests to plugin endpoints
Restrict access to /wp-content/plugins/woocommerce-order-details/ by IP allowlist where feasible
Rotate WooCommerce API keys and review order data exposure if unauthorized access is suspected

bash

# Example nginx rule restricting plugin endpoint access
location ~* /wp-content/plugins/woocommerce-order-details/ {
    allow 10.0.0.0/8;
    deny all;
}