CVE-2026-94375 Details

A vulnerability allowing sensitive information exposure has been identified in the Order Export & Order Import for WooCommerce plugin for WordPress, affecting all versions through 2.7.8. The issue arises in the 'get_file_path' function, where unauthenticated attackers can access exported order CSV files containing personal customer information, such as names, addresses, email and phone numbers, and order details. This exploitation can occur over HTTP without authentication, particularly when the .htaccess and index.php guard files are missing from the 'wp-content/webtoffee_export/' directory. Such a scenario can happen after uninstalling and reinstalling the plugin, during migrations, after restoring backups, or syncing staging sites, as the export directory remains but the guard files are lost. The vulnerability is further exacerbated by the predictable naming of export files, which can be brute-forced within any suspected export timeframe.

Users are advised to update the Order Export & Order Import for WooCommerce plugin to version 2.7.9 or a newer patched version.