{"id":"CVE-2026-56065","kind":"vulnerability","aliases":["CVE-2026-56065"],"related":[],"title":"Doofinder for WooCommerce: sensitive data in public files leaks to visitors","description":"Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofinder-for-woocommerce allows Retrieve Embedded Sensitive Data.This issue affects Doofinder for WooCommerce: from n/a through 2.17.2.","summary":"Doofinder for WooCommerce, a WordPress plugin, writes sensitive information into a file or directory that web visitors can reach. An attacker can retrieve that embedded sensitive data without logging in.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["doofinder","package","php","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in the plugin header of `doofinder-for-woocommerce`.","fix":"- Doofinder for WooCommerce: a version later than `2.17.2`; the sources do not name the exact fixed version.","status":"open","published_at":"2026-11-04T08:17:17+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","triaged_at":"2026-11-04T08:26:28+00:00","updated_at":"2026-11-04T08:26:28+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-04T08:26:28Z","model":"claude-haiku-5-5","output":{"fix":"- Doofinder for WooCommerce: a version later than `2.17.2`; the sources do not name the exact fixed version.","reach":"internet","title":"Doofinder for WooCommerce: sensitive data in public files leaks to visitors","impact":"medium","summary":"Doofinder for WooCommerce, a WordPress plugin, writes sensitive information into a file or directory that web visitors can reach. An attacker can retrieve that embedded sensitive data without logging in.","audience":"businesses","category":"package","nicknames":[],"who_cares":["woocommerce","wordpress","doofinder","php"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Visitors retrieve embedded sensitive data from the plugin's public files","analyst_note":"Find the vendor advisory or the fixed version and the exact file holding the embedded data, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-56065.","how_to_check":"- Check the installed plugin version in WordPress admin under Plugins, or in the plugin header of `doofinder-for-woocommerce`.\n- unknown for the exact file or directory that holds the data; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Stores running the Doofinder for WooCommerce WordPress plugin at version 2.17.2 or earlier are in the affected range. The sources do not say which configuration exposes the data, so the team should confirm whether the plugin's files are reachable from the web. unknown for anything beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000716,"input_tokens":4140,"output_tokens":604,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-56065':14A,17A '2.17.2':86C 'access':59C 'affect':79C 'allow':73C 'attack':43B 'cve':12A,15A 'data':5A,49B 'data.this':77C 'directori':36B,62C 'doofind':1A,18B,23B,65C,66C,70C,80C 'doofinder-for-woocommerc':69C 'embed':47B,75C 'extern':58C 'externally-access':57C 'file':8A,34B,60C 'inform':31B,55C 'insert':52C 'issu':78C 'leak':9A 'log':51B 'n/a':84C 'packag':19B 'php':20B 'plugin':28B 'public':7A 'reach':41B 'retriev':45B,74C 'sensit':4A,30B,48B,54C,76C 'visitor':11A,39B 'vulner':63C 'web':38B 'without':50B 'woocommerc':3A,21B,25B,68C,72C,82C 'wordpress':22B,27B 'write':29B","nicknames":[],"mitigations":[],"who_affected":"Stores running the Doofinder for WooCommerce WordPress plugin at version 2.17.2 or earlier are in the affected range. The sources do not say which configuration exposes the data, so the team should confirm whether the plugin's files are reachable from the web. unknown for anything beyond that.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["doofinder","high","package","php","woocommerce","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T08:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-56065","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-56065","severity":null,"published_at":"2026-11-04T08:17:17+00:00","modified_at":"2026-11-04T08:17:17+00:00","first_seen_at":"2026-11-04T08:25:59+00:00","fetched_at":"2026-11-04T08:25:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}