CVE-2026-9612

Name of the Vulnerable Software and Affected Versions WhatsOrder – Instant Checkout for WooCommerce versions prior to 1.0.2

Description The plugin is susceptible to sensitive information exposure through the yapacdev generate order pdf function. Unauthenticated attackers can extract personally identifiable information (PII) and order details—such as full names, email addresses, phone numbers, billing addresses, ordered items, quantities, prices, coupons, shipping methods, and order totals—by enumerating sequential order IDs. This occurs because invoice HTML files are stored in the publicly accessible wp-content/uploads/whatsorder invoices/ directory without an .htaccess deny rule or index.php guard, allowing direct downloads over HTTP without authentication.

Recommendations Update the plugin to a version newer than 1.0.1. Restrict access to the wp-content/uploads/whatsorder invoices/ directory to prevent unauthorized downloads of invoice files.