# Doofinder for WooCommerce <= 2.17.2 - Unauthenticated Sensitive Information Exposure via Log Files

- **ID:** WPSEC-2026-2067
- **Plugin:** DOOFINDER Search and Discovery for WP & WooCommerce (`doofinder-for-woocommerce`), https://wordpress.org/plugins/doofinder-for-woocommerce/
- **Affected versions:** all versions before 2.17.3
- **Fixed in:** 2.17.3 (Update to 2.17.3 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-532
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/doofinder-for-woocommerce
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2067/

## Description

The DOOFINDER Search and Discovery for WP & WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure via log files in all versions up to, and including, 2.17.2. This is due to the plugin always writing the Doofinder API key, setup wizard tokens, callback URLs, migrated option values and full REST request dumps to log files with fixed names in the wp-content/uploads/doofinder-logs directory, which is protected only by a legacy 'Deny from All' .htaccess rule. Nginx ignores that rule, and so does Apache 2.4 unless mod_access_compat is enabled. This makes it possible for unauthenticated attackers to download the log files on affected servers and obtain the Doofinder API key, which is also the token for the plugin's index-status REST endpoint.

## References

- https://wpsec.com/vuln/WPSEC-2026-2067/
- https://plugins.svn.wordpress.org/doofinder-for-woocommerce/tags/2.17.3/
- https://wordpress.org/plugins/doofinder-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2067/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.