Unrated
Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter
The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's email address.
Announced Source revision 1
Original source ↗CVE-2026-94275
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-94275
Track Orders for WooCommerce
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Unknown",
"product": "Track Orders for WooCommerce",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.2.7",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-94275
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #12446 · Revision 1
- Added to Heist Feed
- Publisher date