When an Order CSV Export Becomes an Attack Vector
A customer can type a spreadsheet formula into an order note. If the export writes it out raw, opening the file runs it on a staff computer.
Category: Security
Practical WordPress and WooCommerce security — untrusted input, export endpoints, access control and the vulnerabilities that do not live on the website itself.