{
 "id": "WPSEC-2026-0558",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0558/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0558/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0558/index.md",
 "title": "Order Tracking <= 3.5.4 - Unauthenticated Sensitive Information Exposure via Front-End Order Download",
 "description": "The Order Tracking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.4 via the customer and sales representative order download feature. The front-end download reused the administrator export, including private fields and a user-selectable record type, and was authorized only by a customer or sales representative ID and email address, both of which the plugin placed in the download form. This makes it possible for unauthenticated attackers to extract private order notes, email addresses and phone numbers, as well as the complete list of customers or sales representatives, on sites where order downloads are enabled.",
 "plugin": {
  "slug": "order-tracking",
  "name": "Order Tracking",
  "full_name": "Order Tracking – WordPress Status Tracking Plugin",
  "wordpress_org": "https://wordpress.org/plugins/order-tracking/",
  "advisories_url": "https://wpsec.com/vuln/plugin/order-tracking/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/order-tracking"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-200"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.6.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.6.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.6.0",
 "remediation": "Update to 3.6.0 or later.",
 "fix_released": "2026-10-05T15:28:19+00:00",
 "published": "2026-10-07T15:58:04+00:00",
 "updated": "2026-10-07T15:30:55.999728+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0558/",
  "https://plugins.svn.wordpress.org/order-tracking/tags/3.6.0/",
  "https://wordpress.org/plugins/order-tracking/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/order-tracking",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-07"
 }
}