CVE-2026-56065 · Package
NO FIX YET · SEE WHAT TO DO
Doofinder for WooCommerce, a WordPress plugin, writes sensitive information into a file or directory that web visitors can reach. An attacker can retrieve that embedded sensitive data without logging in.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Stores running the Doofinder for WooCommerce WordPress plugin at version 2.17.2 or earlier are in the affected range. The sources do not say which configuration exposes the data, so the team should confirm whether the plugin's files are reachable from the web. unknown for anything beyond that.
Not affected if plugin-not-installed
Who cares doofinder, php, woocommerce, wordpress
doofinder-for-woocommerce.2.17.2; the sources do not name the exact fixed version.Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-56065") · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.