On our almost-vanilla WooCommerce site the address and name data from the last customer-order pre-populated the form fields on the checkout page e.g. https://examplesite.eu/checkout/ exposing the data to the next customers going to checkout page. A big GDPR problem for us.

Install was (almost) out-the-box WooCommerce with Storefront theme hosted with SiteGround. checkout page from WooCommerce. Updating to the latest version of WooCommerce fixed the issue.

Checking security logs (wordfence, WP audit etc) showed no security issues.

Now we have a GDPR enquiry and I'm trying to understand what may have caused the problem.

Does WooCommerce query the database to pre-populate the checkout form if user has made previous purchase from site? Presumably though that would depend on cookies on client side, roughly

(if cookie('been-here-before') == true){prepopulate-form}   

Could server side caching cause the problem?

At this stage I'm just looking for pointers/ideas to investigate rather than a full code solution (as i say, problem is fixed by update, I just need to understand issues and vulnerabilities better). Thank you.

Answer: SiteGround's optimiser-caching plugin was the likely problem, it had a major version release and quickly went through several successive updates as issues arose - https://www.siteground.com/blog/sg-optimizer-new-version/

We are confident only one customer's details were exposed and avoided a major GDPR investigation.

closed as off-topic by Michael, shanebp, Jacob Peattie, rudtek, bosco Dec 12 at 7:25

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

  • For starters your SSL is not valid. Sure your server isn't compromised? – Tim Hallman Dec 4 at 17:59
  • 1
    Pure speculation, but my guess is that your outdated version of Woo was session hijacked, which is why updating it corrected the issue. – Tim Hallman Dec 4 at 18:01
  • @ Tim - the site is hosted on SiteGround, they've assured us the server isn't compromised and I believe them, as it's their core business. – silver darling Dec 6 at 19:53
  • @tim Our SSL is fine. The example link was meant to be an example. Sorry if that wasn't clear. Question updated.. – silver darling Dec 6 at 19:55
  • @tim WooComm plugin was only 1 minor version behind latest. Hijacking WooComm sessions isn't as easy as it was 5 years ago. – silver darling Dec 6 at 20:11

Answer: SiteGround's optimiser-caching plugin was the likely problem, it had a major version release and quickly went through several successive updates as issues arose - https://www.siteground.com/blog/sg-optimizer-new-version/

  • Yikes. One of the reasons I never cache cart/checkout/form pages etc. Glad you figured it out. – Tim Hallman Dec 9 at 19:19

Not the answer you're looking for? Browse other questions tagged or ask your own question.