CVE-2026-52694

Vulnerability

The Signature Add-On for WooCommerce plugin (slug: woocommerce-digital-signature) versions 2.0 and below contain an unauthenticated sensitive data exposure vulnerability. The plugin fails to properly restrict access to sensitive data, allowing any unauthenticated user to retrieve information that should be protected [1].

Exploitation

An attacker can exploit this vulnerability by sending a crafted HTTP request to a vulnerable endpoint without requiring any authentication or user interaction. The attack can be performed remotely over the network, making it easy to automate in mass-exploit campaigns [1].

Impact

Successful exploitation leads to the exposure of sensitive data, such as customer signatures or order details, which are normally not accessible to regular users. This information disclosure can be used to further compromise the system or for identity theft [1].

Mitigation

The vulnerability is fixed in version 2.0.1 of the plugin. Users are advised to update immediately. No virtual patch is available due to the specific nature of the vulnerability. If updating is not possible, consult a hosting provider or developer for assistance [1].