Doofinder for WooCommerce <= 2.17.2 - Unauthenticated Sensitive Information Exposure via Log Files
- ID
- WPSEC-2026-2067
- Plugin
- DOOFINDER Search and Discovery for WP & WooCommerce (doofinder-for-woocommerce)
- Affected
- all versions before 2.17.3
- Remediation
- Update to 2.17.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-532
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Doofinder for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The DOOFINDER Search and Discovery for WP & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via log files in all versions up to, and including, 2.17.2. This is due to the plugin always writing the Doofinder API key, setup wizard tokens, callback URLs, migrated option values and full REST request dumps to log files with fixed names in the wp-content/uploads/doofinder-logs directory, which is protected only by a legacy 'Deny from All' .htaccess rule. Nginx ignores that rule, and so does Apache 2.4 unless mod_access_compat is enabled. This makes it possible for unauthenticated attackers to download the log files on affected servers and obtain the Doofinder API key, which is also the token for the plugin's index-status REST endpoint.
References
- https://wpsec.com/vuln/WPSEC-2026-2067/
- https://plugins.svn.wordpress.org/doofinder-for-woocommerce/tags/2.17.3/
- https://wordpress.org/plugins/doofinder-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS