CVE-2026-14562 — Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure

CVE-2026-14562

Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Order Data Disclosure PUBLISHED

Description (CNA)

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments, allowing unauthenticated attackers to disclose other customers' order and attachment data.

Affected (CNA)

Vendor / product	Versions
Unknown / teddy-bear-customize-addon	affected 0 through 1.0.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/890f55f9-0bd0-4816-a666-a735b41ce5c7/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.