The WP Helper Premium WordPress plugin contains an authorization bypass vulnerability that allows unauthenticated users to access and manipulate sensitive order data.

This vulnerability is an authorization bypass (CWE-639) where the plugin fails to perform necessary capability checks on order keys. Unauthenticated attackers can leverage this to view personal information of other customers and change order statuses via malicious AJAX requests.

This flaw leads to the exposure of personally identifiable information (PII) and facilitates unauthorized manipulation of business transactions. With a CVSS score of 8.2, the risk of customer data leakage and business process disruption is high, potentially leading to legal liabilities and loss of customer trust.

Immediate Action: Update the WP Helper Premium plugin to version 4.7.6 or later to ensure proper authorization checks are enforced on order-related actions.

Proactive Monitoring: Monitor server access logs for unusual patterns of AJAX requests directed at order confirmation endpoints, particularly those originating from unauthorized sessions.

Compensating Controls: Use a Web Application Firewall (WAF) to filter requests targeting order confirmation modules if the plugin cannot be updated immediately.

Public Exploit Available: Yes, a proof-of-concept exists as reported by security researchers.

The ability for unauthenticated users to view and modify order data is a significant security failure. Organizations using WP Helper Premium should apply the 4.7.6 update immediately to close this authorization gap and secure customer order information.