CVE-2026-94375

Name of the Vulnerable Software and Affected Versions Order Export & Order Import for WooCommerce versions prior to 2.7.9

Description An issue exists in the get file path function that allows unauthenticated attackers to extract exported order CSV files containing customer personally identifiable information (PII), such as names, billing and shipping addresses, email addresses, phone numbers, and order contents, directly over HTTP. This occurs when the .htaccess and index.php guard files are missing from the wp-content/webtoffee export/ directory, a state that can happen during uninstall/reinstall cycles, migrations, backup restores, or staging syncs. Because export filenames use a deterministic second-precision timestamp pattern, they can be discovered through brute-force attacks within a suspected export window.

Recommendations Update to a version newer than 2.7.8. Ensure that the .htaccess and index.php guard files are present in the wp-content/webtoffee export/ directory to prevent direct HTTP access to exported files.