CVE-2026-94375: Order Export & Order Import for WooCommerce <= 2.7.8 - Unauthenticated Sensitive File Exposure via Missing Directory Guard Re-verification in get_file_path()
The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the getfilepath. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing customer PII — including names, billing and shipping addresses, email addresses, phone numbers, and order contents — directly over HTTP with no authentication. This is exploitable whenever the .htaccess and index.php guard files are absent from wp-content/webtoffeeexport/, which can occur after any uninstall/reinstall cycle, migration, backup restore, or staging sync, since the export directory persists but its guard files do not; export filenames follow a fully deterministic second-precision timestamp pattern, making them brute-forceable across any suspected export window.
Affected Software
Event History
Frequently Asked Questions
When is a site exposed to unauthenticated download of exported order files?
Exposure requires the .htaccess and index.php guard files to be absent from wp-content/webtoffee_export/. This condition can occur after an uninstall and reinstall, migration, backup restore, or staging synchronization because the export directory persists while its guard files do not.
What information could an attacker obtain?
An attacker could download exported order CSV files containing customer names, billing and shipping addresses, email addresses, phone numbers, and order contents.
Does exploitation require an account or user interaction?
No. The issue can be exploited over HTTP without authentication or user interaction when the export directory guard files are missing.
How could an attacker locate an export file?
Export filenames use a deterministic timestamp pattern with second-level precision. An attacker can brute-force likely filenames for a suspected export time window.
What can be checked while a patch is not available?
Check whether wp-content/webtoffee_export/ contains both the .htaccess and index.php guard files, particularly after reinstalling the plugin or performing migrations, restores, or staging syncs.