CVE-2026-9612 describes a vulnerability in the WhatsOrder – Instant Checkout for WooCommerce plugin for WordPress, affecting all versions up to and including 1.0.1. The vulnerability arises because invoice HTML files are saved in the wp-content/uploads/whatsorder_invoices/ directory, which is publicly accessible and lacks access control mechanisms like .htaccess deny rules or index.php guards. Attackers can enumerate sequential order IDs to retrieve sensitive customer information including PII and order details without authentication via the yapacdev_generate_order_pdf functionality. This constitutes an exposure of sensitive information (CWE-200).

The vulnerability allows unauthenticated attackers to access sensitive customer information such as full names, email addresses, phone numbers, billing addresses, ordered items with quantities and prices, applied coupons, shipping methods, and order totals. This exposure can lead to privacy violations and potential misuse of customer data. There is no indication of impact on data integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to restrict access to the wp-content/uploads/whatsorder_invoices/ directory by implementing server-level access controls such as .htaccess deny rules or moving invoice files to a non-public directory. Monitoring for unauthorized access attempts to this directory is also advisable.