CVE-2026-93370: Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint

Q: Which sites are exposed to this issue?

Sites using Paystack WooCommerce Payment Gateway version 5.8.5 or earlier are exposed only if the optional custom metadata feature is enabled in the Paystack gateway settings.

Q: What does an attacker need to exploit it?

No authentication is required. An attacker can enumerate sequential WooCommerce order IDs and use the order-pay endpoint's key parameter to obtain information embedded in the page HTML.

Q: What information could be disclosed?

Exposed data can include customer billing name, email address, phone number, billing and shipping addresses, and the list of purchased products.

Q: What can be done if updating is not immediately possible?

Disable the optional custom metadata feature in the Paystack gateway settings, since the issue is only exploitable when that feature is enabled.

Published Nov 7, 2026

Updated

The Paystack WooCommerce Payment Gateway plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.8.5 via the 'key' parameter. This makes it possible for unauthenticated attackers to extract customer PII — including billing name, email address, phone number, billing address, shipping address, and purchased product list — embedded into page HTML via wplocalizescript by enumerating sequential order IDs. This is only exploitable when the merchant has enabled the optional custom metadata feature in the Paystack gateway settings.

Event History

Nov 7, 2026

CVE Published

via MITRE·06:39 AM

Data Sourced

via MITRE·06:39 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·07:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to this issue?

Sites using Paystack WooCommerce Payment Gateway version 5.8.5 or earlier are exposed only if the optional custom metadata feature is enabled in the Paystack gateway settings.

What does an attacker need to exploit it?

No authentication is required. An attacker can enumerate sequential WooCommerce order IDs and use the order-pay endpoint's key parameter to obtain information embedded in the page HTML.

What information could be disclosed?

Exposed data can include customer billing name, email address, phone number, billing and shipping addresses, and the list of purchased products.

What can be done if updating is not immediately possible?

Disable the optional custom metadata feature in the Paystack gateway settings, since the issue is only exploitable when that feature is enabled.

CVE-2026-93370: Paystack WooCommerce Payment Gateway <= 5.8.5 - Unauthenticated Sensitive Information Exposure in 'key' Parameter on order-pay Endpoint

Event History

Frequently Asked Questions

Which sites are exposed to this issue?

What does an attacker need to exploit it?

What information could be disclosed?

What can be done if updating is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to this issue?

What does an attacker need to exploit it?

What information could be disclosed?

What can be done if updating is not immediately possible?