CVE-2026-94275

{
  "etk_id": "ETK-2026-1340",
  "cve_id": "CVE-2026-94275",
  "display_id": "CVE-2026-94275",
  "ghsa_id": "GHSA-f82x-57h2-9789",
  "euvd_id": "EUVD-2026-94754",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing order authorization in Track Orders for WooCommerce",
  "summary": "Track Orders for WooCommerce versions before 1.2.7 may expose customer billing details and order history because order ownership is not verified before returning data. An unauthenticated attacker may retrieve this information if they know or can supply a customer's email address.",
  "mitigation": "Update Track Orders for WooCommerce to version 1.2.7 or later. Restrict public access to order-tracking functionality until the update is applied.",
  "vendor": null,
  "product": "Track Orders for WooCommerce",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.2.7"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.2.7"
      ],
      "package_name": "Track Orders for WooCommerce",
      "purl": null
    }
  ],
  "cwes": [
    200
  ],
  "cvss_score": 5.3,
  "cvss_src": "nvd",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "epss_score": 0.0021,
  "epss_percentile": 0.1005,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 27.578120866666666,
  "t0_at": "2026-10-08T06:00:09.401000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-08T06:00:09.401000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-08T06:00:09.401000+00:00",
      "url": "https://github.com/advisories/GHSA-f82x-57h2-9789"
    }
  }
}