← back to popular plugins
wordfence / plugin · live-sales-notifications-for-woocommerce

PiWeb Live sales notification for WooCommerce

live-sales-notifications-for-woocommerce
total installs
50,000
total vulns
2
critical
0
high
1
medium
1
low
0
latest vuln
—
patched
1
unpatched
1
avg time to patch
—
vulnerabilities (2)
Live sales notification for WooCommerce <= 2.3.46 - Missing Authorization
medium ✕ unpatched
cve id CVE-2026-27066 ↗
cvss score 5.3
cwe CWE-862: Missing Authorization
published Jan 11, 2026
The Live sales notification for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.3.46. This makes it possible for unauthenticated attackers to perform an unauthorized action.
Live sales notification for WooCommerce <= 2.3.39 - Missing Authorization to Unauthenticated Customer Data Exposure
high ✓ patched
cve id CVE-2025-12955 ↗
cvss score 7.5
cwe CWE-862: Missing Authorization
published Nov 17, 2025
The Live sales notification for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.39. This is due to the "getOrders" function lacking proper authorization and capability checks when the plugin is configured to display recent order information. This makes it possible for unauthenticated attackers to extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details.