Atomic Edge analysis of CVE-2026-9612 (metadata-based): This vulnerability exposes sensitive customer data in the WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress. All versions up to and including 1.0.1 are affected. The vulnerability allows unauthenticated attackers to enumerate and download invoice HTML files containing personal identifiable information (PII) and order details. The CVSS score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating a medium severity issue with low impact on confidentiality.
Root Cause: The likely root cause, based on the CWE-200 classification and the description, is that the plugin generates invoice files with predictable filenames tied to sequential order IDs. It stores these files in the wp-content/uploads/whatsorder_invoices/ directory without access controls. The directory lacks an .htaccess deny rule or index.php guard. The function yapacdev_generate_order_pdf creates these files, but the filenames (likely something like order-{ID}.html or invoice-{ID}.html) are enumerable. Atomic Edge analysis infers this from the vulnerability description; no source code confirmation is available since the plugin is not downloadable.
Exploitation: An attacker can exploit this vulnerability by sending HTTP GET requests directly to the invoice files in the publicly accessible directory. The attack targets URLs structured like: https://example.com/wp-content/uploads/whatsorder_invoices/invoice-{order_id}.html. For example, an attacker might use a script to iterate through order IDs starting from 1 until they find valid invoices. The attack requires no authentication and can be executed with a simple browser or curl request. No special headers or payloads are needed; the attacker simply accesses the file over HTTP. The description confirms that no authentication check is performed on these files.
Remediation: The fix requires two changes. First, the plugin should store invoice files outside the web-accessible directory, such as in wp-content/uploads/whatsorder_invoices/ with a .htaccess file that denies all access, or better yet, in a custom directory outside the web root. Second, the plugin should use a non-predictable filename, such as a UUID or a hash of the order ID combined with a secret salt. Additionally, the plugin should implement an access control check when serving invoice files, requiring at least the order’s associated customer to be logged in or to possess a unique token. Since no patched version is available, site administrators should delete the vulnerable plugin directory or replace it with a secure alternative.
Impact: The primary impact is exposure of sensitive customer PII and order details. An attacker can obtain full customer names, email addresses, phone numbers, billing addresses, order items with prices, applied coupons, shipping methods, and order totals. This data leak violates customer privacy and may expose the site owner to regulatory penalties under GDPR, CCPA, or similar laws. The vulnerability does not allow privilege escalation or remote code execution, but the data exposure can aid in targeted phishing attacks or identity theft.
