Order Tracking <= 3.5.4 - Unauthenticated Sensitive Information Exposure via Front-End Order Download
- ID
- WPSEC-2026-0558
- Plugin
- Order Tracking – WordPress Status Tracking Plugin (order-tracking)
- Affected
- all versions before 3.6.0
- Remediation
- Update to 3.6.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-07
- Attack surface
- Order Tracking on WPSec AttackSurface
- Fix released
- Published
Description
The Order Tracking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.4 via the customer and sales representative order download feature. The front-end download reused the administrator export, including private fields and a user-selectable record type, and was authorized only by a customer or sales representative ID and email address, both of which the plugin placed in the download form. This makes it possible for unauthenticated attackers to extract private order notes, email addresses and phone numbers, as well as the complete list of customers or sales representatives, on sites where order downloads are enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0558/
- https://plugins.svn.wordpress.org/order-tracking/tags/3.6.0/
- https://wordpress.org/plugins/order-tracking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS