An unauthenticated authorization bypass in the PiWeb Live sales notification plugin for WooCommerce exposes sensitive customer purchase information to unauthorized actors.

The vulnerability is caused by a missing capability check in the getOrders function, which allows an unauthenticated attacker to retrieve sensitive customer details including names, geographic locations, and purchase history.

Successful exploitation of this vulnerability leads to unauthorized access to sensitive customer data, which poses a significant risk of privacy violations and reputational damage. With a CVSS score of 7.5, this high severity flaw is particularly dangerous because it does not require authentication and is easily automatable, potentially allowing for large-scale data harvesting from affected WooCommerce stores.

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should immediately deactivate and uninstall the PiWeb Live sales notification for WooCommerce plugin until a secure update is released by the developer.

Proactive Monitoring: Monitor server access logs for anomalous requests directed at plugin-specific endpoints or the getOrders function to identify potential unauthorized data access attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious requests to the WooCommerce environment, specifically monitoring for unauthorized access to order-related REST or AJAX endpoints.

Public Exploit Available: Unknown.

Given the high CVSS score and the exposure of PII, this vulnerability poses a severe risk to customer privacy. Security teams must prioritize the immediate removal of the affected plugin from all production WordPress environments until a verified, secure version is available from the vendor.