Executive brief
The Teddy Bear Customize Addon WordPress plugin for WooCommerce allows unauthenticated users to retrieve sensitive order and customer data without proper permission checks. An attacker can access other customers' order information and attachment URLs by exploiting missing authorization controls, exposing private customer data including order metadata and file locations.
Technical details
The teddy-bear-customize-addon plugin fails to implement authorization or ownership checks in its order data retrieval functionality, allowing any unauthenticated attacker to request WooCommerce order metadata and customer attachment URLs via network access. The vulnerability is a missing access control (CWE-200) that permits direct exposure of sensitive data including order details and file paths without requiring authentication or proof of ownership. An attacker can enumerate or request order data by crafting HTTP requests to the vulnerable endpoint, accessing other customers' private information without any authentication or user interaction required. No patch has been made available; the plugin remains vulnerable in versions 1.0.5 and earlier.
Affected products
- WordPress Plugin Developer teddy-bear-customize-addon through 1.0.5
Timeline
- 2026-09-09: disclosed
- 2026-09-11: advisory