CVE-2026-14562
MediumCVSS 5.3Summary
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments. This allows unauthenticated attackers to disclose other customers' order and attachment data.
Risk Assessment
An unauthenticated attacker can access order data and files uploaded by other customers, representing a serious confidentiality breach that may result in personal data leakage. This can lead to legal consequences and loss of customer trust.
Recommendation
Update the teddy-bear-customize-addon plugin to a version later than 1.0.5 or remove it if unused. Assess the scope of potential data leakage and take appropriate GDPR-compliant actions.
Other vulnerabilities in teddy-bear-customize-addon WordPress plugin
See all- CVE-2026-14560Critical
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
- CVE-2026-14559Critical
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.
Original NVD description (English source)
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.