CVE-2025-48331 WordPress WooCommerce Orders & Customers Exporter <= 5.0 - Sensitive Data Exposure Vulnerability

HighCVSS 7.5 EPSS 0.37%

Published: 2025-05-30 17:01
Updated: 2026-06-17 12:29
Exploit status: No public exploit known

Description

Insertion of Sensitive Information Into Sent Data vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-customers-exporter allows Retrieve Embedded Sensitive Data.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.0.

Affected products

Product	Affected versions	Fixed in
vanquish WooCommerce Orders & Customers Exporter	<= 5.0	No fix listed
wordpress woocommerce-orders-customers-exporter(WordPress)	<= 5.0	No fix listed

References

patchstack.com vdb-entry
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v3.1

7.5 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

All scores (3)

v3.1 7.5 · patchstack
v3.1 4.3 · wordfence
v3.1 7.5 · audit@patchstack.com

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.37% (percentile 31.5)
CWE: CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-201 Insertion of Sensitive Information Into Sent Data

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.