CVE-2026-56065: WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability
Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Doofinder for WooCommerceto a version that resolves this vulnerability.Fixed in 2.17.3
Event History
Frequently Asked Questions
Which installations are affected?
Doofinder for WooCommerce versions through 2.17.2 are affected. The available data does not identify a safe fixed version.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the potential impact?
An attacker may retrieve sensitive data embedded in an externally accessible file or directory. The provided scoring indicates high confidentiality impact, with no stated integrity or availability impact.