Számlázz.hu integráció WooCommerce-hez <= 6.2.2 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Request XML Files
- ID
- WPSEC-2026-1677
- Plugin
- Számlázz.hu integráció WooCommerce-hez (integration-for-szamlazzhu-woocommerce)
- Affected
- all versions before 6.3
- Remediation
- Update to 6.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weakness
- CWE-538
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Számlázz.hu integráció WooCommerce-hez on WPSec AttackSurface
- Fix released
- Published
Description
The Számlázz.hu integráció WooCommerce-hez plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.2. Before each request to Számlázz.hu, the plugin writes the full request XML, including the Számla Agent API key and the customer's billing data, to the unprotected uploads/wc_szamlazz/ folder under a predictable name based on the sequential order ID ({orderId}.xml). The file stays there for the whole outbound request and is never deleted when the request fails with an HTTP or connection error. This makes it possible for unauthenticated attackers to download the file and obtain the merchant's Számla Agent API key and customer billing data. The attacker must request the file while the request to Számlázz.hu is running, or after a failed request leaves the file behind.
References
- https://wpsec.com/vuln/WPSEC-2026-1677/
- https://plugins.svn.wordpress.org/integration-for-szamlazzhu-woocommerce/tags/6.3/
- https://wordpress.org/plugins/integration-for-szamlazzhu-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS