CVE-2026-94375 (CVSS 5.3)

Description

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing customer PII — including names, billing and shipping addresses, email addresses, phone numbers, and order contents — directly over HTTP with no authentication. This is exploitable whenever the .htaccess and index.php guard files are absent from wp-content/webtoffee_export/, which can occur after any uninstall/reinstall cycle, migration, backup restore, or staging sync, since the export directory persists but its guard files do not; export filenames follow a fully deterministic second-precision timestamp pattern, making them brute-forceable across any suspected export window.

Is your site exposed to CVE-2026-94375?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS — Exploit Prediction

0.0029

Probability of exploitation

0.20%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-552 CWE-552

References

Other References

https://plugins.trac.wordpress.org/browser/order-import-export-for-woocommerce/tags/2.7.8/admin/modules/export/export.php#L720 https://plugins.trac.wordpress.org/browser/order-import-export-for-woocommerce/tags/2.7.8/admin/modules/export/export.php#L887 https://plugins.trac.wordpress.org/browser/order-import-export-for-woocommerce/tags/2.7.8/uninstall.php#L32 https://plugins.trac.wordpress.org/browser/order-import-export-for-woocommerce/tags/2.7.9/admin/modules/export/export.php https://plugins.trac.wordpress.org/browser/order-import-export-for-woocommerce?rev=3733247 https://www.wordfence.com/threat-intel/vulnerabilities/id/726d0a00-b64b-4dfc-a498-d7decb6b5ebd?source=cve

Frequently Asked Questions

What is CVE-2026-94375? +

The Order Export & Order Import for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8 via the get_file_path. This makes it possible for unauthenticated attackers to extract download exported order CSV files containing customer PII — including names, billing and shipping addresses, email addresses, phone numbers, and order contents — directly over HTTP with no authentication. This is exploitable whenever the .htaccess and index.php guard files are absent from wp-content/webtoffee_export/, which can occur after any uninstall/reinstall cycle, migration, backup restore, or staging sync, since the export directory persists but its guard files do not; export filenames follow a fully deterministic second-precision timestamp pattern, making them brute-forceable across any suspected export window. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2026-94375? +

CVE-2026-94375 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance. The EPSS score is 0.0029, placing it in the 0th percentile for exploitation probability.

How do I check if I'm vulnerable to CVE-2026-94375? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2023-29080

Potential privilege escalation vulnerability in Revenera InstallShield versions 2022 R2 and 2021 R2 due to adding InstallScript custom action to …

CVE-2025-22369

The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from …

CVE-2025-1982

Local File Inclusion vulnerability in Ready's attachment upload panel allows low privileged user to provide link to a local file …

CVE-2025-34110

A directory traversal vulnerability exists in ColoradoFTP Server ≤ 1.3 Build 8 for Windows, allowing unauthenticated attackers to read or …

CVE-2025-34139

A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow …

CVE-2009-10005

ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 expose the mimencode binary via a CGI endpoint, …

CVE-2026-94375