CVE-2026-56065

WordPress Doofinder for WooCommerce plugin <= 2.17.2 - Sensitive Data Exposure vulnerability

State: published CNA: Patchstack CVSS 3.1 7.5 High NVD: deferred

Description

Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2.

Affected products

Vendor	Product	Versions
Doofinder	Doofinder for WooCommerce	≤2.17.2

References

External links from the record. They lead to third-party sites.

https://patchstack.com/database/wordpress/plugin/doofinder-for-woocommerce/vulnerability/wordpress-doofinder-for-woocomm… vdb-entry

Dates

Reserved: 2026-06-18
Published: 2026-11-04
Updated: 2026-11-04

CVSS

7.5 High

Version: 3.1
Source: CNA (Patchstack)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.245% probability of exploitation activity in the next 30 days

Percentile: 15.851%
Score date: 2026-11-04
Model: v2026.06.15

Weakness

CWE-538 Insertion of Sensitive Information into Externally-Accessible File or Directory

NVD

Status: Deferred
Published: 2026-11-04
Modified: 2026-11-04

7.5 High CVSS 3.1 · Patchstack, secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

This CVE at nvd.nist.gov