CVE-2026-94375 Overview
CVE-2026-94375 is a sensitive information exposure vulnerability in the Order Export & Order Import for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 2.7.8 through the get_file_path function. Unauthenticated attackers can download exported order CSV files containing customer personally identifiable information (PII). The exposed data includes names, billing and shipping addresses, email addresses, phone numbers, and order contents. Exploitation requires the absence of the .htaccess and index.php guard files in wp-content/webtoffee_export/, a condition triggered by uninstall/reinstall cycles, migrations, backup restores, or staging syncs.
Critical Impact
Unauthenticated attackers can retrieve exported order CSV files containing customer PII directly over HTTP by brute-forcing deterministic timestamp-based filenames.
Affected Products
- Order Export & Order Import for WooCommerce plugin for WordPress
- All versions up to and including 2.7.8
- Fixed in version 2.7.9
Discovery Timeline
- 2026-10-10 - CVE-2026-94375 published to NVD
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-94375
Vulnerability Analysis
The vulnerability resides in the get_file_path function within the plugin's export module (admin/modules/export/export.php). The plugin writes exported order data to CSV files stored in wp-content/webtoffee_export/. Protection of this directory relies on two guard files: an .htaccess file denying direct HTTP access and an index.php file preventing directory listing. The exported CSV files contain complete order records including customer PII fields such as names, billing addresses, shipping addresses, phone numbers, email addresses, and purchased items. This flaw is categorized under CWE-552: Files or Directories Accessible to External Parties.
Root Cause
The plugin's uninstall.php script removes guard files when the plugin is uninstalled, but the webtoffee_export/ directory and its CSV contents persist on disk. When administrators reinstall the plugin, perform a site migration, restore a backup, or sync a staging environment, the directory is recreated or retained without the .htaccess and index.php protections. The export directory then becomes directly reachable over HTTP, exposing any CSV files it holds.
Attack Vector
An unauthenticated attacker sends HTTP GET requests to wp-content/webtoffee_export/ with predicted filenames. Export filenames follow a deterministic second-precision timestamp pattern, which means an attacker who estimates when an export occurred can brute-force the filename across a time window. Successful requests return the full CSV file with customer PII. No credentials, user interaction, or elevated privileges are required. The attack is strictly a confidentiality issue; data is not modified or destroyed.
See the vendor source references in export.php line 720, export.php line 887, and uninstall.php line 32 for the vulnerable code paths.
Detection Methods for CVE-2026-94375
Indicators of Compromise
- Unauthenticated HTTP GET requests to URIs containing /wp-content/webtoffee_export/ returning HTTP 200 responses.
- Sequential or brute-force request patterns probing filenames that match a second-precision timestamp format.
- Missing .htaccess or index.php files inside the wp-content/webtoffee_export/ directory.
- Web server access logs showing CSV downloads from unknown or external IP addresses.
Detection Strategies
- Audit the wp-content/webtoffee_export/ directory for the presence of guard files and alert when either file is missing.
- Parse web server access logs for direct requests to the export directory and flag any unauthenticated retrievals.
- Monitor for high-volume HTTP request bursts to filenames matching timestamp patterns, indicative of brute-force enumeration.
Monitoring Recommendations
- Enable detailed access logging on the web server covering the wp-content/ path and retain logs for forensic review.
- Baseline normal export activity and alert on anomalous access from external sources.
- Integrate WordPress and web server telemetry into a centralized SIEM to correlate directory probing with other scanning behavior.
How to Mitigate CVE-2026-94375
Immediate Actions Required
- Upgrade the Order Export & Order Import for WooCommerce plugin to version 2.7.9 or later immediately.
- Verify that wp-content/webtoffee_export/ contains the .htaccess and index.php guard files after any plugin install, migration, or restore operation.
- Delete historical CSV exports from wp-content/webtoffee_export/ that are no longer needed, and move required exports off the web-accessible path.
- Review web server access logs for prior unauthorized downloads from the export directory and notify affected customers if PII exposure is confirmed.
Patch Information
The vendor addressed the issue in version 2.7.9 of the plugin. Review the fixed code in the v2.7.9 export module and the full plugin revision 3733247. Additional analysis is available in the Wordfence vulnerability record.
Workarounds
- Manually recreate the .htaccess and index.php guard files inside wp-content/webtoffee_export/ to deny direct HTTP access and prevent directory indexing.
- Configure the web server (Apache or Nginx) to deny direct access to the webtoffee_export/ directory at the server configuration level.
- Relocate exported CSV files to a storage location outside the web-accessible document root.
- Restrict access to wp-content/webtoffee_export/ with IP allowlisting or authentication at the reverse proxy or WAF layer.
# Example Apache .htaccess guard file for wp-content/webtoffee_export/
Order Allow,Deny
Deny from all
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
