Vulnerabilities CVE-2026-19073

CVE-2026-19073

None

Open

TLP:CLEAR

Order Sync with Zendesk for WooCommerce < 2.2.3 - Unauthenticated Customer Order Data Disclosure

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.

Details

EPSS Score ⓘ: 0.21%

10.9th percentile
Confidence: 90%
Published: Aug 12, 2026
Last Modified: Aug 12, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.