# Számlázz.hu integráció WooCommerce-hez <= 6.2.2 - Unauthenticated Sensitive Information Exposure via Publicly Accessible Request XML Files

- **ID:** WPSEC-2026-1677
- **Plugin:** Számlázz.hu integráció WooCommerce-hez (`integration-for-szamlazzhu-woocommerce`), https://wordpress.org/plugins/integration-for-szamlazzhu-woocommerce/
- **Affected versions:** all versions before 6.3
- **Fixed in:** 6.3 (Update to 6.3 or later.)
- **Severity:** Medium 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
- **Weakness:** CWE-538
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/integration-for-szamlazzhu-woocommerce
- **Fix released:** 2026-10-25
- **Published:** 2026-10-26
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1677/

## Description

The Számlázz.hu integráció WooCommerce-hez plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.2. Before each request to Számlázz.hu, the plugin writes the full request XML, including the Számla Agent API key and the customer's billing data, to the unprotected uploads/wc_szamlazz/ folder under a predictable name based on the sequential order ID ({orderId}.xml). The file stays there for the whole outbound request and is never deleted when the request fails with an HTTP or connection error. This makes it possible for unauthenticated attackers to download the file and obtain the merchant's Számla Agent API key and customer billing data. The attacker must request the file while the request to Számlázz.hu is running, or after a failed request leaves the file behind.

## References

- https://wpsec.com/vuln/WPSEC-2026-1677/
- https://plugins.svn.wordpress.org/integration-for-szamlazzhu-woocommerce/tags/6.3/
- https://wordpress.org/plugins/integration-for-szamlazzhu-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1677/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.