CVE-2026-94275: Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need authentication or user interaction. They need to supply the email address of a customer whose order information they want to retrieve.
What information could be exposed?
The affected plugin may return a customer's billing name, email address, phone number, postal address, and order history. The disclosure occurs because the plugin does not verify that the requester owns the order.
Which installations are affected?
Track Orders for WooCommerce versions earlier than 1.2.7 are affected. The available information does not identify any configuration prerequisite.