What is GHSA-75cj-4j6f-h35h?

GHSA-75cj-4j6f-h35h is a security advisory published by GitHub Security Advisories with Medium severity. The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any...

Which CVE IDs does GHSA-75cj-4j6f-h35h cover?

GHSA-75cj-4j6f-h35h covers the following CVE IDs: CVE-2026-19073. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-75cj-4j6f-h35h?

GHSA-75cj-4j6f-h35h has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-75cj-4j6f-h35hMediumCVSS 5.3

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any...

Vendor

GitHub Security Advisories

Published

August 12, 2026

Last Modified

August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-19073 →

📋 Description

The Order Sync with Zendesk for WooCommerce WordPress plugin before 2.2.3 does not perform any capability check on one of its REST API endpoints, and does not verify that the requester owns the account being queried, allowing unauthenticated attackers to retrieve the order history and purchase totals of any customer whose email address they know or can enumerate.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-19073
https://wpscan.com/vulnerability/8c8ca8ff-e0e8-4e9c-b79b-7f95816a9113
https://github.com/advisories/GHSA-75cj-4j6f-h35h