PT-2026-51696 · Yapacdev · Whatsorder – Instant Checkout For Woocommerce

Benedictus Jovan · Published 2026-06-24 · Updated 2026-06-24 · CVE-2026-9612

NVD

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

The WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.1 via the yapacdev generate order pdf. This makes it possible for unauthenticated attackers to extract sensitive customer PII and order details — including full name, email address, phone number, billing address, ordered items with quantities and prices, applied coupons, shipping method, and order total — from any customer's invoice by enumerating sequential order IDs. Invoice HTML files are written to the publicly accessible wp-content/uploads/whatsorder invoices/ directory, which is created without an .htaccess deny rule or index.php guard, making every invoice directly downloadable over HTTP with no authentication check.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-9612

Affected Products

Whatsorder – Instant Checkout For Woocommerce

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-9612 · Security Note
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.0/whatsorder-instant-checkout-for-woocommerce.php#L225 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e5d625d6-57e0-4dc7-b3ee-cb0639a02230?source=cve · Note
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.1/whatsorder-instant-checkout-for-woocommerce.php#L225 · Note
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.0/whatsorder-instant-checkout-for-woocommerce.php#L222 · Note
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.1/whatsorder-instant-checkout-for-woocommerce.php#L222 · Note
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.1/whatsorder-instant-checkout-for-woocommerce.php#L159 · Note
• https://plugins.trac.wordpress.org/browser/whatsorder-instant-checkout-for-woocommerce/tags/1.0.0/whatsorder-instant-checkout-for-woocommerce.php#L159 · Note