CVE-2026-18357 Details
Description
The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuses, fee amounts and order dates.
A vulnerability exists in the WPC Order Tip for WooCommerce WordPress plugin in versions prior to 3.3.1. The issue arises because the plugin's reporting feature does not implement proper authorization or nonce checks. This oversight allows unauthenticated attackers to access sensitive order information from any customer, including billing names, order IDs and statuses, fee amounts, and order dates.
Users are advised to update the WPC Order Tip for WooCommerce WordPress plugin to version 3.3.1 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Aug 9, 2026CISA-ADP
Assessed Aug 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/ff675d0a-03f2-4309-830c-0e96e1d95a62/ | [email protected] | AdvisoryExploitRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| WPC Order Tip | < 3.3.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 10, 2026 | CVE Modified | CISA-ADP |
| Aug 9, 2026 | New CVE Received | [email protected] |