{
 "id": "WPSEC-2026-2067",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2067/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2067/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2067/index.md",
 "title": "Doofinder for WooCommerce <= 2.17.2 - Unauthenticated Sensitive Information Exposure via Log Files",
 "description": "The DOOFINDER Search and Discovery for WP & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via log files in all versions up to, and including, 2.17.2. This is due to the plugin always writing the Doofinder API key, setup wizard tokens, callback URLs, migrated option values and full REST request dumps to log files with fixed names in the wp-content/uploads/doofinder-logs directory, which is protected only by a legacy 'Deny from All' .htaccess rule. Nginx ignores that rule, and so does Apache 2.4 unless mod_access_compat is enabled. This makes it possible for unauthenticated attackers to download the log files on affected servers and obtain the Doofinder API key, which is also the token for the plugin's index-status REST endpoint.",
 "plugin": {
  "slug": "doofinder-for-woocommerce",
  "name": "Doofinder for WooCommerce",
  "full_name": "DOOFINDER Search and Discovery for WP & WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/doofinder-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/doofinder-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/doofinder-for-woocommerce"
 },
 "type": "SENSITIVE DATA DISCLOSURE",
 "cwe": [
  "CWE-532"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.17.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.17.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.17.3",
 "remediation": "Update to 2.17.3 or later.",
 "fix_released": "2026-10-29T13:04:55+00:00",
 "published": "2026-10-30T13:53:52+00:00",
 "updated": "2026-10-29T17:42:59.511012+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2067/",
  "https://plugins.svn.wordpress.org/doofinder-for-woocommerce/tags/2.17.3/",
  "https://wordpress.org/plugins/doofinder-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/doofinder-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}