CVE-2026-52694: WordPress Signature Add-On for WooCommerce plugin <= 2.0 - Sensitive Data Exposure vulnerability

Synopsis

This is a sensitive data exposure vulnerability in the Signature Add-On for WooCommerce WordPress plugin at version 2.0 and below. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially accessible to any remote attacker. Successful exploitation allows an attacker to read sensitive data stored or processed by the plugin, such as customer signature records associated with WooCommerce orders. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable service must be reachable over the network; an attacker can send crafted requests from anywhere on the internet without needing a foothold on the host.

• AuthenticationNot required

  No account or session credential of any kind is needed; the vulnerable endpoint is accessible to unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully passive from the victim's perspective and requires no action from any user of the affected site.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special preconditions such as race conditions or specific memory layout requirements.

Blast Radius

• An attacker reads sensitive data handled by the plugin, which in a WooCommerce context can include customer signature images and the order records they are attached to.
• No write or delete capability is implied by the vulnerability; data integrity and service availability are not directly affected by this flaw.
• Exposed signature records may contain personally identifiable information, creating compliance obligations under privacy regulations for affected site operators.