PT-2026-89774

CVE-2026-14562

Published

2026-09-09

Updated

2026-09-17

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions teddy-bear-customize-addon versions prior to 1.0.6

Description The plugin fails to perform authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments. This allows unauthenticated attackers to disclose sensitive order and attachment data belonging to other customers.

Recommendations Update teddy-bear-customize-addon to version 1.0.6 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

0Xbassia

Vendors

Affected products

Weakness enumeration

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Related identifiers