CVE-2020-29156: Woocommerce

Medium severity, CVSS 5.3. EPSS: 4% chance of exploitation in the next 30 days.

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the order_id parameter in a fetch_order_status action.

Affected products

• Woocommerce Woocommerce: before 4.7.0 (fixed in 4.7.0)

Published 2020-12-27. Last modified 2026-06-17.