Vulnerability · Published Oct 29, 2025 · Assigned by Wordfence
CVE-2023-7320WooCommerce <= 7.8.2 - Sensitive Information Exposure
Medium 5.3
In plain English
A medium-severity information exposure in WooCommerce from automattic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Official description
The WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.8.2, due to improper CORS handling on the Store API's REST endpoints allowing direct external access from any origin. This can allow unauthenticated attackers to extract sensitive user information including PII(Personal Identifiable Information).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| automattic | WooCommerce | 0 – through 7.8.2 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7b2d1879-c337-41c9-9f47-f9c2fe8e5928?source=cve
- https://wpscan.com/vulnerability/d1cec296-b5df-4cea-8c0d-d03a975cb6af
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2939652@woocommerce/trunk&old=2933569@woocommerce/trunk&sfp_email=&sfph_mail=