CVE-2022-41655 MEDIUM

CVE-2022-41655: WordPress Phone Orders for WooCommerce plugin <= 3.7.1 - Auth. Sensitive Data Exposure vulnerability

Vendor Algolplus
Product Phone Orders for WooCommerce (WordPress plugin)
Weakness CWE-200 · Info exposure
Published November 18, 2022
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress.

Explanation of Vulnerability in Simple Terms

02Summary

The Phone Orders for WooCommerce plugin through version 3.7.1 exposes sensitive order information to authenticated users who should not have access to it. A logged-in user with low privileges can view order details they do not own. The vulnerability stems from insufficient access controls on order data endpoints. Update to a version newer than 3.7.1 to resolve this issue.

What an attacker can do

03Attacker Capabilities

View order details and sensitive information belonging to other customers.

Potential impact on your site

04Site Impact

Customer order data and personal information may be exposed to other logged-in users, risking privacy violations and customer trust.

Conditions required to exploit

05Prerequisites

Attacker must be logged in to the WordPress site with a low-privilege account (e.g., subscriber or customer).

Key dates

06Disclosure timeline

November 18, 2022 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-9183 24liveblog <= 2.2 - Authenticated (Contributor+) Exposure of Sensitive Information via Block Editor Script Localization CVE-2025-15482 Chapa Payment Gateway Plugin for WooCommerce <= 1.0.3 - Unauthenticated Sensitive Information Exposure CVE-2026-2268 Ninja Forms <= 3.14.0 - Unauthenticated Information Disclosure in nf_ajax_submit AJAX Action CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy CVE-2026-16773 WPBot <= 8.5.9 - Unauthenticated Sensitive Information Exposure in 'wpbot_send_email_transcript' AJAX Action