CVE-2026-56065

{
  "etk_id": "ETK-2026-3473",
  "cve_id": "CVE-2026-56065",
  "display_id": "CVE-2026-56065",
  "ghsa_id": "GHSA-2rjp-mrq2-jh6r",
  "euvd_id": "EUVD-2026-116770",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Public file exposure in Doofinder for WooCommerce",
  "summary": "Doofinder for WooCommerce through version 2.17.2 may place sensitive information in files or directories reachable from the web. An unauthenticated remote attacker may retrieve that embedded information when the affected files are publicly accessible.",
  "mitigation": "Restrict web access to plugin files and directories that could contain sensitive data, and remove any sensitive material from publicly reachable locations. Disable the plugin if access controls cannot be applied, and monitor for a vendor update.",
  "vendor": "Doofinder",
  "product": "Doofinder for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.17.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "doofinder-for-woocommerce",
      "purl": null
    }
  ],
  "cwes": [
    538
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.01231195,
  "t0_at": "2026-11-04T08:00:16.083000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-04T08:21:16.156563+00:00",
      "days": 0.014584184756944445,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T08:00:16.083000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-04T08:00:16.083000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-04T08:00:16.083000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-56065"
    }
  }
}