Junglewise Threat Intelligence

CVE-2026-9612: yapacdev WhatsOrder Sensitive Information Exposure in yapacdev_generate_order_pdf

CVE-2026-9612 · Severity: medium · CVSS 5.3 · Published 2026-06-24

Executive brief

A vulnerability in the WhatsOrder plugin for WordPress allows unauthorized individuals to access and download customer invoices. This exposure includes sensitive personal information such as names, email addresses, phone numbers, and physical addresses, as well as order details and pricing. An attacker can systematically download these documents because they are stored in a public folder without proper security protections.

Technical details

The WhatsOrder plugin fails to implement proper access controls or directory protection for generated invoice files. Specifically, the 'yapacdev_generate_order_pdf' function writes invoice HTML files to a publicly accessible directory (wp-content/uploads/whatsorder_invoices/) that lacks an .htaccess deny rule or an index.php guard. An unauthenticated remote attacker can exploit this by enumerating sequential order IDs to guess the filenames and directly download invoices over HTTP. This results in the exposure of sensitive customer PII, including full names, contact details, billing addresses, and full order histories.

Affected products

  • yapacdev WhatsOrder – Instant Checkout for WooCommerce up to, and including, 1.0.1

Timeline

  • 2026-06-24: disclosed
  • 2026-06-24: advisory

References