CVE-2026-14562
Received Received - Intake

Unauthenticated Order Data Exposure in Teddy Bear Customize Addon

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: WPScan

Description
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-14562
EUVD
EUVD-2026-75960

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
teddy-bear-customize-addon teddy-bear-customize-addon 1.0.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the Teddy Bear Customize Addon WordPress plugin (version 1.0.5 or below). It allows unauthenticated attackers to access sensitive order data and customer-uploaded attachment URLs without proper authorization checks. The plugin fails to verify ownership or permissions before returning this information.

Detection Guidance

To detect this vulnerability, check if the WordPress plugin 'Teddy Bear Customize Addon' version 1.0.5 or below is installed. Test for unauthenticated access to WooCommerce order metadata and customer-uploaded attachment URLs by attempting to retrieve order data without authentication.

Impact Analysis

Unauthenticated attackers can view other customers' order details and private attachments. This exposes personal data, financial information, and sensitive files. If you use this plugin, your customers' data may be at risk of unauthorized access and potential misuse.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to personal and sensitive data. GDPR requires strict data protection and user consent, while HIPAA mandates safeguards for protected health information. The exposure of such data could lead to legal penalties and compliance failures.

Mitigation Strategies

Immediately update the plugin to the latest version if an update is available. If no update exists, consider disabling or removing the plugin until a patch is released. Restrict access to sensitive order data and customer attachments through server-side measures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart