Medium

WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter

Disclosed: 21.01.2020
Updated: 11.10.2026 10:22

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
Composer package	woocommerce/woocommerce	< 4.7.0	4.7.0
WordPress plugin	WooCommerce	< 4.7.0	4.7.0

References

CVSS score 5.3/10

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness (CWE): CWE-863, CWE-639
Platform: Composer, WordPress
Package: woocommerce/woocommerce, WooCommerce
Disclosed: 21.01.2020
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-wwh8-v3j3-gxfw - CC BY 4.0

Wordfence Intelligence - 4279efe9-df57-405a-85a0-6c22e912662c - Wordfence Intelligence

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Wordfence Intelligence

Wordfence Intelligence - Defiant, Inc.
Copyright Defiant, Inc. All rights reserved except as granted below.
License grant, section 3.1 of the Wordfence Intelligence Terms and Conditions (January 26, 2026):

Subject to this Agreement, Company hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute the Service. Any copy you make for such purposes is authorized provided that you reproduce Company’s copyright designation, this license, and the license of any disclosed Company licensor in any such copy.

Full applicable Agreement: https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/

Vulnerability history: WooCommerce

All published vulnerabilities of this package (WordPress plugin), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (46) in the archive

Total entries: 46
First → latest: 07.2013 09.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 11
Medium 34
Low 1

Disclosures per year

2017: 1
2018: 3
2019: 3
2020: 4
2021: 2
2022: 5
2023: 3
2024: 7
2025: 4
2026: 3

earlier: 11

07.09.2026

WooCommerce < 11.1.0 - Unauthenticated Denial of Service

High · 7.5 CVE-2026-48888 < 11.1.0 11.1.0
22.02.2022

WooCommerce <= 6.2.0 - Path Traversal via Tax Importer

High · 7.2 5cbf597e-7a2f-416c-8969-3679b487f57a <= 6.2.0 6.2.1
13.07.2021

WooCommerce < 5.5 - Authenticated Blind SQL Injection

High · 8.8 CVE-2021-32790 < 3.3, >= 3.3, <= 3.3.5, >= 3.4, <= 3.4.7, >= 3.5, <= 3.5.8, >= 3.6, <= 3.6.5, >= 3.7, <= 3.7.1, >= 3.8, <= 3.8.1, >= 3.9, <= 3.9.3, >= 4.0, <= 4.0.1, >= 4.1, <= 4.1.1, >= 4.2, <= 4.2.2, >= 4.3, <= 4.3.3, >= 4.4, <= 4.4.1, >= 4.5, <= 4.5.2, >= 4.6, <= 4.6.2, >= 4.7, <= 4.7.1, = 4.8, >= 4.9, <= 4.9.2, = 5.0, = 5.1, >= 5.2, <= 5.2.2, = 5.3, >= 5.4, <= 5.4.1, = 5.5 3.3.6, 3.4.8, 3.5.9, 3.6.6, 3.7.2, 3.8.2, 3.9.4, 4.0.2, 4.1.2, 4.2.3, 4.3.4, 4.4.2, 4.5.3, 4.6.3, 4.7.2, 4.8.1, 4.9.3, 5.0.1, 5.1.1, 5.2.3, 5.3.1, 5.4.2, 5.5.1, 5.5.2
05.05.2020

WooCommerce <= 4.0.4 - Unauthorized Post Meta Creation/Modification

High · 8.8 c232b39c-7144-4d3a-9770-883986ca8b29 < 4.1.0 4.1.0
21.01.2020

WooCommerce < 4.7.0 - Insecure Direct Object Reference via order_id Parameter this entry

Medium · 5.3 CVE-2020-29156 < 4.7.0 4.7.0
02.07.2019

WooCommerce <= 3.6.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

High · 8.8 2edb574d-74b7-4f72-91a1-bb6632709b7a < 3.6.5 3.6.5
02.07.2019

WooCommerce <= 3.6.4 - Missing File Type Validation

High · 7.2 162a194c-a7de-44c4-a659-8188e303b6a2 <= 3.6.4 3.6.5
06.11.2018

WooCommerce <= 3.4.5 - WooCommerce File Deletion

High · 7.2 CVE-2018-20714 < 3.4.6 3.4.6
16.11.2017

WooCommerce <= 3.2.3 - Authenticated PHP Object Injection

High · 8.8 CVE-2017-18356 < 3.2.4 3.2.4
10.06.2015

WooCommerce <= 2.3.10 - PHP Object Injection

High · 7.5 88b3a69d-2c94-48e6-b965-8a67b2fe42b2 <= 2.3.10 2.3.11
13.03.2015

WooCommerce <= 2.3.5 - Stored Cross-Site Scripting

High · 7.2 CVE-2015-2329 < 2.3.6 2.3.6
15.09.2014

WooCommerce <= 2.2.2 - Cross-Site Scripting via range Parameter

High · 7.3 CVE-2014-6313 < 2.2.3 2.2.3

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application