CVE-2026-19073

Deferred Deferred - Pending Action

Unauthenticated Order Data Exposure in Order Sync with Zendesk for WooCommerce

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-19073

EUVD

EUVD-2026-57107

Affected Vendors & Products

Vendor	Product	Version / Range
woocommerce	order_sync_with_zendesk	to 2.2.3 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability affects the Order Sync with Zendesk for WooCommerce plugin before version 2.2.3. It allows unauthenticated attackers to access sensitive customer order data, including order history and purchase totals, by exploiting a lack of capability checks and ownership verification in one of its REST API endpoints. Attackers only need to know or guess a customer's email address to retrieve this information.

Detection Guidance

Check if the 'Order Sync with Zendesk for WooCommerce' plugin is installed and verify its version. If it is below 2.2.3, the system is vulnerable. Use WordPress admin panel or run a command like 'wp plugin list' in the WordPress directory to check the plugin version.

Impact Analysis

This vulnerability can lead to unauthorized access to sensitive customer data, including order history and purchase totals. Attackers can retrieve this information by knowing or guessing a customer's email address, potentially exposing private financial and personal details.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and other privacy regulations by exposing sensitive customer order data, including purchase history and totals, without authorization. Unauthorized access to personal data violates GDPR principles of data protection and user consent.

Mitigation Strategies

Update the 'Order Sync with Zendesk for WooCommerce' plugin to version 2.2.3 or later immediately. If updating is not possible, consider disabling the plugin temporarily until an update is applied.

Hi! I’m here to help you understand CVE-2026-19073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70