CVE-2026-94275 WordPress.org CVE debrief

Who should care

Defenders responsible for WordPress installations with Track Orders for WooCommerce plugin versions before 1.2.7 should assess exposure and prioritize remediation. This includes operators, platform administrators, vulnerability management teams, and security teams who manage or monitor WordPress environments. They should verify exposure, prioritize remediation, and monitor for potential disclosure attempts to prevent unauthorized access to customer PII

Why it matters

CVE-2026-94275 allows unauthenticated PII disclosure in Track Orders for WooCommerce plugin versions before 1.2.7. Defenders should verify exposure, prioritize remediation, and monitor for potential disclosure attempts.

• Potential unauthorized disclosure of customer PII
• Possible exploitation by unauthenticated attackers
• Verification of plugin version and exposure required
• Remediation priority for vulnerable plugin versions

Technical summary

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address. This vulnerability can be exploited by unauthenticated attackers, potentially leading to unauthorized disclosure of customer PII. Defenders should prioritize verifying exposure and remediation for Track Orders for WooCommerce plugin versions before 1.2.7

Defensive priority

Defenders should prioritize verifying exposure and remediation for Track Orders for WooCommerce plugin versions before 1.2.7

Recommended defensive actions

• Verify exposure of Track Orders for WooCommerce plugin versions before 1.2.7
• Remediate vulnerable plugin versions to 1.2.7 or later
• Monitor for potential unauthenticated PII disclosure attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address. Source-provided details indicate that defenders should verify exposure and prioritize remediation for vulnerable plugin versions. Evidence limits suggest that defenders should focus on verifying plugin versions and monitoring for P

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.