CVE-2026-94375 webtoffee CVE debrief

Who should care

Defenders responsible for WordPress installations with the Order Export & Order Import for WooCommerce plugin should assess exposure and prioritize verification of guard files and plugin updates.

Why it matters

The vulnerability allows unauthenticated attackers to extract sensitive information from exported order CSV files, including customer PII. Defenders should prioritize verification of guard files and plugin updates to prevent exploitation.

• Verify the presence of guard files to prevent unauthorized access to exported order CSV files.
• Ensure the plugin is updated to a version that fixes the vulnerability to prevent exploitation.
• Monitor for suspicious activity to detect potential unauthorized access to sensitive information.

Technical summary

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to sensitive information exposure in versions up to and including 2.7.8. The vulnerability exists due to a missing directory guard re-verification in the get_file_path() function, allowing unauthenticated attackers to extract downloaded exported order CSV files containing customer PII. Export filenames follow a deterministic second-precision timestamp pattern, making them brute-forceable across any suspected export window. This vulnerability can be exploited when .htaccess and index.php guard files are absent from the export directory, which can occur after uninstall/reinstall, migration, backup restore, or staging sync. Defenses

Defensive priority

Defenders should prioritize verifying the presence of guard files in the export directory and ensuring the plugin is updated to a version that fixes the vulnerability.

Recommended defensive actions

• Verify the presence of .htaccess and index.php guard files in the wp-content/webtoffee_export/ directory.
• Ensure the Order Export & Order Import for WooCommerce plugin is updated to a version that fixes the vulnerability.
• Monitor for suspicious activity, such as unauthorized access to exported order CSV files.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability exists due to a missing directory guard re-verification in the get_file_path() function. Export filenames follow a deterministic second-precision timestamp pattern, making them brute-forceable. The vulnerability is exploitable when .htaccess and index.php guard files are absent from the export directory, which can occur after uninstall/reinstall, migration, backup restore, or staging sync.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.