CVE-2026-39542
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WordPress plugin Doofinder for WooCommerce (doofinder-for-woocommerce) by Doofinder has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 2.10.13.
Risk Assessment
An attacker may intercept sensitive data transmitted by the plugin, potentially leading to information disclosure or further security breaches.
Recommendation
Update the Doofinder for WooCommerce plugin to a version above 2.10.13 if a patch is available, or audit configuration for data leakage.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through <= 2.10.13.