CVE-2026-9612: WhatsOrder WooCommerce Info Disclosure Flaw

CVE-2026-9612 Overview

CVE-2026-9612 is a sensitive information exposure vulnerability in the WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 1.0.1 and resides in the yapacdev_generate_order_pdf functionality. Unauthenticated attackers can extract customer personally identifiable information (PII) and order details by enumerating sequential order IDs. Invoice HTML files are written to the publicly accessible wp-content/uploads/whatsorder_invoices/ directory without an .htaccess deny rule or index.php guard, allowing direct HTTP download without authentication. The vulnerability is categorized as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Unauthenticated remote attackers can harvest full customer PII including names, email addresses, phone numbers, billing addresses, order items, prices, coupons, shipping methods, and order totals from every invoice on the site.

Affected Products

WordPress plugin: WhatsOrder – Instant Checkout for WooCommerce, versions through 1.0.1
WordPress sites using the affected plugin with WooCommerce
Any WooCommerce store that generated invoices via yapacdev_generate_order_pdf

Discovery Timeline

2026-06-24 - CVE-2026-9612 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-9612

Vulnerability Analysis

The WhatsOrder plugin generates customer invoices as HTML files stored in wp-content/uploads/whatsorder_invoices/. This directory is web-accessible by default under standard WordPress installations. The plugin fails to deploy any access control mechanism for the directory or its contents. No .htaccess deny rule is written, no index.php placeholder blocks directory listing, and no authentication or capability check gates retrieval of invoice files. Attackers issue HTTP GET requests for invoice files referenced by predictable, sequential WooCommerce order IDs.

The issue is tracked through the plugin source code on the WordPress Plugin Trac repository at the yapacdev_generate_order_pdf handler and the file write operations. See the WordPress Plugin Code Segment at line 159 and the Wordfence Vulnerability Report for additional technical context.

Root Cause

The root cause is a missing authorization and access control design for generated invoice artifacts. The plugin writes sensitive order data to a publicly served upload directory without protecting that directory at the web server layer or validating requester identity at the application layer.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker enumerates order IDs and requests URLs of the form https://victim.tld/wp-content/uploads/whatsorder_invoices/<order_id>.html. Each successful response leaks one customer's full invoice contents.

// Conceptual exploitation flow (no exploit code provided in source data)
// 1. Identify the WordPress site running WhatsOrder plugin
// 2. Request invoice files by iterating sequential order IDs
// 3. Parse returned HTML for PII fields
// See Wordfence advisory for verified technical details

Detection Methods for CVE-2026-9612

Indicators of Compromise

Anomalous HTTP GET request volume against the path /wp-content/uploads/whatsorder_invoices/ from a single or distributed source
Sequential numeric file enumeration patterns in web server access logs targeting the invoices directory
Successful HTTP 200 responses for .html files inside whatsorder_invoices/ originating from non-administrative IP addresses

Detection Strategies

Inspect web server and WAF logs for repeated requests to wp-content/uploads/whatsorder_invoices/ with incrementing filename patterns
Alert on user agents commonly associated with scrapers and scanning frameworks accessing the invoices directory
Correlate request bursts against the invoices directory with the absence of an authenticated session cookie

Monitoring Recommendations

Enable directory access logging at the web server level for all wp-content/uploads/ subdirectories
Forward WordPress and reverse-proxy logs to a centralized SIEM for retention and rule-based alerting
Monitor for outbound bulk data transfer correlated with inbound scraping behavior against WooCommerce stores

How to Mitigate CVE-2026-9612

Immediate Actions Required

Deactivate the WhatsOrder – Instant Checkout for WooCommerce plugin until a patched release is verified
Remove existing invoice files from wp-content/uploads/whatsorder_invoices/ after exporting any required records to a protected location
Deploy a web server rule that denies direct HTTP access to the invoices directory
Notify affected customers if log analysis indicates invoice files were retrieved by unauthorized parties

Patch Information

No fixed version is identified in the available NVD data. Versions up to and including 1.0.1 are vulnerable. Review the Wordfence Vulnerability Report for the latest vendor status and any subsequent patched release.

Workarounds

Add an .htaccess deny rule or index.php placeholder inside wp-content/uploads/whatsorder_invoices/ to block direct file access
Move the invoices directory outside the web root and serve invoices through an authenticated PHP handler that validates user capability and order ownership
Configure a WAF rule blocking unauthenticated requests to the whatsorder_invoices path

bash

# Apache: deny direct access to the invoices directory
cat > wp-content/uploads/whatsorder_invoices/.htaccess <<'EOF'
Require all denied
EOF

# Nginx: add to server block
# location ~* /wp-content/uploads/whatsorder_invoices/ {
#     deny all;
#     return 403;
# }