CVE-2026-94375

Executive Summary

CVE-2026-94375 is a sensitive information exposure vulnerability in the "Order Export & Order Import for WooCommerce" WordPress plugin, affecting all versions up to and including 2.7.8. The flaw resides in the get_file_path function, which fails to enforce authentication or authorization controls when serving exported order CSV files, allowing unauthenticated attackers to retrieve customer PII directly over HTTP. With no patch available and a deterministic filename pattern, any WordPress site running this plugin with missing .htaccess or index.php guard files in wp-content/webtoffee_export/ is at risk of mass customer data exfiltration.

Technical Analysis

The vulnerability is classified as CWE-552 (Files or Directories Accessible to External Parties). The plugin generates CSV exports of WooCommerce orders—containing customer names, billing and shipping addresses, email addresses, phone numbers, and order contents—and stores them under wp-content/webtoffee_export/. Access control for these files relies on two mechanisms: an .htaccess file and an index.php guard file placed within that directory to block direct HTTP access.

The get_file_path function, referenced in the NVD description, does not independently verify that a requesting user is authenticated or authorized before resolving and serving a file path. This means the security model depends entirely on web server–level directory protections rather than application-level access control. When the .htaccess and index.php guard files are absent, the export directory becomes directly browsable and files are retrievable over HTTP without authentication.

The guard files can be lost through routine operational events: an uninstall/reinstall cycle of the plugin, a site migration, a backup restore, or a staging-to-production sync. In each case, the export directory itself persists on disk (including previously generated CSVs), but the guard files are not recreated—leaving a residual data store exposed. This is a classic "orphaned data" condition: the plugin's runtime protections vanish while its output artifacts remain.

Compounding the exposure, export filenames follow a "fully deterministic second-precision timestamp pattern." Instead of random or hash-based names, filenames are predictable based on the time an export was generated. An attacker who suspects a site performs scheduled exports (e.g., nightly order reconciliation) can brute-force filenames across a narrow time window with a small number of requests, rather than needing to guess an unguessable value.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a network-accessible, low-complexity attack requiring no privileges or user interaction. Notably, the confidentiality subscore is C:N while integrity is I:L—an unusual assignment for a data exposure flaw. The score of 5.3 (Medium) should be interpreted as a baseline; in practice, the aggregation of PII across many orders can represent a severe privacy and regulatory impact that numeric scoring understates.

No public proof-of-concept, exploit code, or Nuclei template is currently available. The attack chain described below is inferred from the vulnerability class (unauthenticated file access / sensitive information exposure) and the specific artifacts named in the NVD description. No patch exists, and no vendor advisory or affected-version package metadata has been published.

Exploitation Scenarios

Step 1 — Reconnaissance / Target Identification. An attacker identifies WordPress sites running the "Order Export & Order Import for WooCommerce" plugin. Plugin presence can be fingerprinted through public web content, asset paths, and known plugin directory conventions. Shodan-style dorks targeting wp-content/webtoffee_export/ or plugin-specific page titles accelerate discovery at scale.

Step 2 — Triggering the Flaw Class. The attacker issues direct HTTP GET requests to the export directory (wp-content/webtoffee_export/) to test whether directory listing or direct file retrieval succeeds. If the .htaccess and index.php guard files are absent—due to an uninstall/reinstall, migration, backup restore, or staging sync—the request returns exported CSV content or a directory index instead of a 403/404 response. No authentication is required at any point.

Step 3 — Payload / Execution Method. Because filenames follow a deterministic second-precision timestamp pattern, the attacker enumerates plausible filenames across a suspected export window. Each guess is a simple HTTP request; a successful match returns a CSV file. This is a low-noise, low-complexity enumeration that requires no crafted payloads, no authentication bypass, and no user interaction.

Step 4 — Post-Exploitation Impact. Retrieved CSVs yield bulk customer PII: names, billing and shipping addresses, email addresses, phone numbers, and full order contents. This data enables follow-on phishing, account takeover attempts, fraud, and doxxing, and it constitutes a reportable personal data breach under regimes such as GDPR and CCPA. Because the source of exposure is a predictable static file path, the same technique can be applied across many discovered targets with minimal per-target effort.

Note: No public PoC is available; the above attack chain is inferred from the vulnerability class and the artifacts explicitly named in the NVD description.

Impact Assessment

The primary impact is confidentiality loss affecting WooCommerce customers whose orders were exported. The blast radius is every unpatched WordPress installation (≤ 2.7.8) where the export directory lacks its guard files. Because the flaw requires no authentication (PR:N), no user interaction (UI:N), and is network-exploitable with low complexity (AC:L), exposure is broad and easily automated.

The CVSS vector reports C:N/I:L, reflecting a formal scoring that underweights the real-world sensitivity of aggregated PII. Practically, the confidentiality impact is HIGH: a single accessible directory can leak the full order history's worth of customer records. The I:L (Low integrity) component corresponds to the potential for path resolution manipulation within the get_file_path logic, though the dominant risk remains unauthorized disclosure.

Regulatory and business consequences include mandatory breach notification, potential fines, reputational damage, and downstream fraud against affected customers. Because the exposure can persist invisibly after routine maintenance operations, many site operators will be unaware their data is reachable.

Detection Guidance

Sigma Rule

title: WooCommerce Order Export Plugin Unauthenticated CSV Access
id: 7c3a9f21-0b4e-4c8a-9d31-2f8e6a5b1c44
status: experimental
description: Detects HTTP GET requests to the webtoffee_export directory that may indicate unauthenticated retrieval of exported order CSVs (CVE-2026-94375).
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri-stem|contains:
      - '/wp-content/webtoffee_export/'
  selection_method:
    cs-method: 'GET'
  selection_status:
    sc-status:
      - 200
      - 206
  filter_guard:
    cs-uri-stem|endswith:
      - '/index.php'
      - '/.htaccess'
  condition: selection_path and selection_method and selection_status and not filter_guard
falsepositives:
  - Legitimate administrator downloads of export files
level: high
tags:
  - attack.t1190
  - cve.2026-94375

YARA Rule

rule CVE_2026_94375_WooCommerce_Export_CSV
{
    meta:
        description = "Detects exported WooCommerce order CSV files associated with CVE-2026-94375 sensitive information exposure"
        author = "Threat Intelligence"
        reference = "CVE-2026-94375"
        date = "2026-01-01"
        severity = "high"

    strings:
        $woo_hdr1 = "billing_first_name" nocase
        $woo_hdr2 = "billing_email" nocase
        $woo_hdr3 = "shipping_address_1" nocase
        $woo_hdr4 = "order_total" nocase
        $woo_hdr5 = "order_id" nocase
        $csv_sep = ","

    condition:
        uint32(0) != 0x504b0304 and
        filesize < 50MB and
        (2 of ($woo_hdr*)) and $csv_sep
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-94375 WooCommerce Order Export Unauthenticated CSV Access"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/wp-content/webtoffee_export/"; fast_pattern; http.uri; pcre:"/\/wp-content\/webtoffee_export\/[^\/]*\.csv$/Ui"; classtype:attempted-recon; sid:202694375; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-94375, confidence Medium;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [ network where http.request.method == "GET"
      and url.path : "/wp-content/webtoffee_export/*" ]
  [ network where http.response.status_code in (200, 206)
      and url.path : "/wp-content/webtoffee_export/*.csv" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri=lower(uri)
| where like(uri, "%/wp-content/webtoffee_export/%")
| where match(uri, "\.csv$")
| where status IN (200, 206)
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as statuses by src_ip, uri
| where count >= 1
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,accesslog,cve-2026-94375,">
  <rule id="2026943" level="10">
    <if_sid>31100</if_sid>
    <id>^311..</id>
    <match>webtoffee_export</match>
    <regex>\.csv</regex>
    <description>CVE-2026-94375: Possible unauthenticated WooCommerce order CSV export access</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_94375,data_exposure,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1) Immediate Mitigations

• Restore directory protections: ensure both .htaccess (with Require all denied / deny from all semantics per server) and an empty index.php exist in wp-content/webtoffee_export/. Verify these are recreated after every uninstall/reinstall, migration, backup restore, or staging sync.
• As a stronger control, place the export directory outside the web root, or block HTTP access to wp-content/webtoffee_export/ at the reverse proxy/WAF layer.
• Delete stale exported CSV files once they are no longer needed; do not rely on guard files as the sole protection for persistent PII.
• Restrict or disable the export feature if it is not operationally required.
• Monitor web server logs for requests to wp-content/webtoffee_export/.

2) Patch / Upgrade Steps

• No vendor fix, advisory, or patched version is available at this time. Track the plugin vendor ("Order Export & Order Import for WooCommerce" / WebToffee) for a fixed release and apply it immediately when published.
• Until a patch ships, treat every affected site (≤ 2.7.8) as exposed and apply the mitigations above.

3) Long-Term Hardening

• Enforce application-level authorization on any file-serving logic rather than depending on server guard files. Note: this requires a vendor-side fix, since the get_file_path function is plugin code.
• Adopt a configuration-management check that validates the presence of guard files after every deployment or migration event.
• Minimize on-disk retention of exported PII and encrypt exports at rest.
• Add plugin inventory and version tracking to reduce blind spots for third-party WordPress components.

References

• NVD — CVE-2026-94375: https://nvd.nist.gov/vuln/detail/CVE-2026-94375
• CWE-552 — Files or Directories Accessible to External Parties: https://cwe.mitre.org/data/definitions/552.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• WebToffee "Order Export & Order Import for WooCommerce" plugin page (WordPress.org plugin repository) — for vendor patch tracking
• CISA KEV Catalog — not applicable; CVE-2026-94375 is not listed and no exploit-in-the-wild or threat actor campaign has been reported as of this assessment.