Threats tagged 'ghsa-hmgg-6xw2-57m9'

The Order Export & Order Import for WooCommerce plugin for WordPress up to version 2.7.8 is vulnerable to sensitive information exposure. Unauthenticated attackers can access exported order CSV files containing customer personally identifiable information (PII) such as names, addresses, emails, phone numbers, and order details. This occurs when protective .htaccess and index.php files are missing from the export directory, a state that can arise after uninstall/reinstall cycles, migrations, backup restores, or staging synchronizations. Export filenames are predictable based on timestamps, enabling brute-force access to files over HTTP without authentication.