WordPress Track Orders for WooCommerce plugin < 1.2.7 - Unauthenticated PII Disclosure vulnerability

Unauthenticated PII Disclosure vulnerability discovered by Pedro Pinho in WordPress Plugin Track Orders for WooCommerce versions 1.2.7...

CVE-2026-94275

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

CVE-2026-94275 Track Orders for WooCommerce < 1.2.7 - Unauthenticated PII Disclosure via 'email' Parameter

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

CVE-2026-94275

The Track Orders for WooCommerce WordPress plugin (versions before 1.2.7 ) contains an unauthenticated PII disclosure vulnerability. The root cause is a failure to verify order ownership before returning billing details. An unauthenticated attacker can obtain sensitive information, including a cu...

EUVD-2026-94754

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

CVE-2026-94275: Exposure of Sensitive Information to an Unauthorized Actor

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

PT-2026-107850

The Track Orders for WooCommerce WordPress plugin before 1.2.7 does not verify ownership of an order before returning its billing details, allowing unauthenticated attackers to obtain a customer's name, email address, phone number, postal address and order history by supplying that customer's ema...

Online Shopping Portal /shopping/track-orders.php SQL Injection Vulnerability

Online Shopping Portal is an online store. Online Shopping Portal suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in /shopping/track-orders.php. No details of the vulnerability are available at this time...

CVE-2025-26156

A SQL Injection vulnerability was found in /shopping/track-orders.php in PHPGurukul Online Shopping Portal v2.1, which allows remote attackers to execute arbitrary code via orderid POST request parameter...

PHPGurukul Online Shopping Portal has a security vulnerability

Online Shopping Portal is an online store. Online Shopping Portal suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in /shopping/track-orders.php. No details of the vulnerability are available at this time...