The WPC Smart Quick View for WooCommerce plugin allows anyone to send requests to the 'woosq_quickview' AJAX endpoint without authentication. Because the plugin does not validate the visibility of the requested product, an attacker can retrieve content from private, password‑protected, or draft items. This forms an insecure direct object reference vulnerability that exposes sensitive product data, consistent with CWE‑639.

Any WordPress site that has the wpclever WPC Smart Quick View for WooCommerce plugin installed with a version equal to or older than 4.2.5. The vendor wpclever is the provider of the affected product.

The CVSS score of 5.3 signals a moderate base severity, and the EPSS score of less than 1% indicates a low likelihood of exploitation in the immediate future; the vulnerability is not listed in the CISA KEV catalog. The sole prerequisite for exploitation is the ability to access the site’s network or a browser that can reach the AJAX endpoint—no administrative privileges or additional software are required. The exposed endpoint can be queried by any unauthenticated user, making it a straightforward denial of confidentiality scenario.