# Order Tracking <= 3.5.4 - Unauthenticated Sensitive Information Exposure via Front-End Order Download

- **ID:** WPSEC-2026-0558
- **Plugin:** Order Tracking – WordPress Status Tracking Plugin (`order-tracking`), https://wordpress.org/plugins/order-tracking/
- **Affected versions:** all versions before 3.6.0
- **Fixed in:** 3.6.0 (Update to 3.6.0 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-200
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/order-tracking
- **Fix released:** 2026-10-05
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0558/

## Description

The Order Tracking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.4 via the customer and sales representative order download feature. The front-end download reused the administrator export, including private fields and a user-selectable record type, and was authorized only by a customer or sales representative ID and email address, both of which the plugin placed in the download form. This makes it possible for unauthenticated attackers to extract private order notes, email addresses and phone numbers, as well as the complete list of customers or sales representatives, on sites where order downloads are enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-0558/
- https://plugins.svn.wordpress.org/order-tracking/tags/3.6.0/
- https://wordpress.org/plugins/order-tracking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0558/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.