CVE-2026-9612

The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the yapacdev_generate_order_pdf. This makes it possible for unauthenticated attackers to extract sensitive customer PII and order details — including full name, email address, phone number, billing address, ordered items with quantities and prices, applied coupons, shipping method, and order total — from any customer's invoice by enumerating sequential order IDs. Invoice HTML files are written to the publicly accessible wp-content/uploads/whatsorder_invoices/ directory, which is created without an .htaccess deny rule or index.php guard, making every invoice directly downloadable over HTTP with no authentication check.

• CWE-200

• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.0/whatsorder-instant-checkout-for-woocommerce.php#L159
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.0/whatsorder-instant-checkout-for-woocommerce.php#L222
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.0/whatsorder-instant-checkout-for-woocommerce.php#L225
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.1/whatsorder-instant-checkout-for-woocommerce.php#L159
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.1/whatsorder-instant-checkout-for-woocommerce.php#L222
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.1/whatsorder-instant-checkout-for-woocommerce.php#L225
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e5d625d6-57e0-4dc7-b3ee-cb0639a02230?source=cve

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96112Out-of-bounds read in DNS Server allows an authorized attack…5.5
• CVE-2026-96113Heap-based buffer overflow in DNS Server allows an unauthori…9.8
• CVE-2026-96115Double free in Windows DHCP Client allows an authorized atta…8
• CVE-2026-96117Heap-based buffer overflow in Windows LUAFV allows an author…7.8
• CVE-2026-96118Out-of-bounds read in Windows Graphics Kernel allows an auth…7.8
• CVE-2026-96119IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authentica…9.9
• CVE-2026-96122Untrusted pointer dereference in Windows Graphics Kernel all…7.8
• CVE-2026-96124Use after free in Windows Graphics Kernel allows an authoriz…7
• CVE-2026-96126Heap-based buffer overflow in Windows Graphics Kernel allows…7.8
• CVE-2026-96127Heap-based buffer overflow in Windows Biometric Service allo…7.8
• CVE-2026-96129Inclusion of functionality from untrusted control sphere in …7.8
• CVE-2026-9613The Datalogics Ecommerce Delivery – Datalogics plugin for Wo…4.3