Boluwatife Opeyemi

**Name of the Vulnerable Software and Affected Versions** Order Export & Order Import for WooCommerce versions prior to 2.7.9 **Description** An issue exists in the `get file path` function that allows unauthenticated attackers to extract exported order CSV files containing customer personally identifiable information (PII), such as names, billing and shipping addresses, email addresses, phone numbers, and order contents, directly over HTTP. This occurs when the `.htaccess` and `index.php` guard files are missing from the `wp-content/webtoffee export/` directory, a state that can happen during uninstall/reinstall cycles, migrations, backup restores, or staging syncs. Because export filenames use a deterministic second-precision timestamp pattern, they can be discovered through brute-force attacks within a suspected export window. **Recommendations** Update to a version newer than 2.7.8. Ensure that the `.htaccess` and `index.php` guard files are present in the `wp-content/webtoffee export/` directory to prevent direct HTTP access to exported files.