CVE-2026-14562: CWE-200 Information Exposure in teddy-bear-customize-addon
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.
AI Analysis
Technical Summary
CVE-2026-14562 is an information exposure vulnerability in the teddy-bear-customize-addon WordPress plugin versions up to 1.0.5. The plugin fails to enforce authorization or ownership verification before returning WooCommerce order metadata and URLs of customer-uploaded attachments. As a result, unauthenticated attackers can retrieve sensitive data belonging to other customers.
Potential Impact
This vulnerability allows unauthorized disclosure of customer order details and uploaded attachment URLs, potentially leading to privacy violations and exposure of sensitive customer information.
Mitigation Recommendations
No patch or official fix information is provided. Users should check the vendor advisory for updates or consider disabling the plugin until a fix is available. Applying strict access controls or removing the plugin can mitigate exposure.
CVE-2026-14562: CWE-200 Information Exposure in teddy-bear-customize-addon
Description
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.
CVSS v3.1
Score 5.3medium
Affected software
teddy-bear-customize-addon
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-14562 is an information exposure vulnerability in the teddy-bear-customize-addon WordPress plugin versions up to 1.0.5. The plugin fails to enforce authorization or ownership verification before returning WooCommerce order metadata and URLs of customer-uploaded attachments. As a result, unauthenticated attackers can retrieve sensitive data belonging to other customers.
Potential Impact
This vulnerability allows unauthorized disclosure of customer order details and uploaded attachment URLs, potentially leading to privacy violations and exposure of sensitive customer information.
Mitigation Recommendations
No patch or official fix information is provided. Users should check the vendor advisory for updates or consider disabling the plugin until a fix is available. Applying strict access controls or removing the plugin can mitigate exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-03T09:48:40.298Z
- State
- PUBLISHED
Threat ID: 6aa3a07a91cc7f3848c78c41
Added to database: 09/11/2026, 06:32:26 UTC
Last enriched: 09/11/2026, 06:49:06 UTC
Last updated: 09/11/2026, 22:23:26 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.