CVE-2026-94275 Overview
The Track Orders for WooCommerce WordPress plugin before version 1.2.7 contains an information disclosure vulnerability. The plugin fails to verify order ownership before returning billing details through its order lookup functionality. Unauthenticated attackers can retrieve a customer's name, email address, phone number, postal address, and order history by supplying only the target customer's email address. The flaw is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Unauthenticated attackers can harvest personally identifiable information (PII) of WooCommerce customers at scale by submitting known or guessed email addresses.
Affected Products
- Track Orders for WooCommerce WordPress plugin versions prior to 1.2.7
- WordPress sites running WooCommerce with the affected plugin enabled
- Customer records stored within WooCommerce order history on vulnerable installations
Discovery Timeline
- 2026-10-08 - CVE-2026-94275 published to NVD
- 2026-10-08 - Last updated in NVD database
Technical Details for CVE-2026-94275
Vulnerability Analysis
The Track Orders for WooCommerce plugin provides a front-end interface that lets customers look up order status. The lookup endpoint accepts an email address as a parameter and returns associated order data. The plugin does not require authentication or any ownership proof such as a session token, order key, or shared secret.
An attacker who submits a victim's email address receives that victim's full billing record. Returned fields include the customer's full name, email, phone number, postal address, and order history. The exposure maps to [CWE-200] and enables bulk PII harvesting using lists of known email addresses.
The disclosed data supports downstream attacks. Phone numbers and postal addresses enable targeted phishing, smishing, and social engineering. Order history reveals purchasing patterns useful for pretexting against the customer or the merchant's support team.
Root Cause
The root cause is a missing authorization check on the order lookup handler. The plugin treats possession of an email address as sufficient proof of identity. It does not pair the email with an order key, authentication cookie, or one-time verification link before returning sensitive data.
Attack Vector
Exploitation requires only network access to the plugin's public lookup endpoint. An attacker submits an HTTP request containing the target email address and parses billing data from the response. The attack is scriptable against email lists and requires no user interaction. Technical details are published in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-94275
Indicators of Compromise
- High-volume POST or GET requests to the Track Orders plugin's lookup endpoint from a single IP or small IP set
- Sequential or dictionary-style email parameter values in web server access logs
- Repeated 200-OK responses with large payloads returned to unauthenticated clients
- Customer complaints about targeted phishing referencing recent WooCommerce orders
Detection Strategies
- Review WordPress and WooCommerce logs for anonymous requests enumerating the plugin's AJAX or REST endpoint used for order tracking
- Alert on anomalous request rates against /wp-admin/admin-ajax.php or custom plugin routes with an email parameter
- Correlate web application firewall (WAF) telemetry for repeated lookups referencing varied email values from the same source
Monitoring Recommendations
- Enable verbose access logging on the order tracking URL and retain logs for retrospective analysis
- Monitor outbound data volume from the WooCommerce host for sustained response size growth tied to the lookup endpoint
- Track plugin version inventory across WordPress estates and alert on installations running versions below 1.2.7
How to Mitigate CVE-2026-94275
Immediate Actions Required
- Upgrade the Track Orders for WooCommerce plugin to version 1.2.7 or later on all WordPress sites
- Audit web server logs for prior enumeration activity against the plugin's lookup endpoint and notify affected customers if evidence of harvesting is found
- Rotate any administrative credentials shared with the plugin and review third-party integrations that consume order data
Patch Information
The vendor fixed the issue in Track Orders for WooCommerce version 1.2.7 by introducing an ownership check prior to returning order details. Refer to the WPScan Vulnerability Report for upstream fix references.
Workarounds
- Disable and remove the Track Orders for WooCommerce plugin until the upgrade can be applied
- Place the plugin's lookup endpoint behind authentication using a WAF rule or reverse proxy restriction
- Rate-limit requests to the plugin's public endpoints to slow enumeration attempts
- Require customers to use the standard WooCommerce account login for order status visibility
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
