The Order Splitter for WooCommerce plugin contains a missing capability check on the 'wos_troubleshooting' AJAX endpoint in all releases up to 5.3.5. This flaw permits any authenticated user with Subscriber-level access or higher to query the endpoint and retrieve order details belonging to other users, thereby exposing sensitive customer data. The flaw corresponds to CWE-862 (Missing Authorization). As the vulnerability allows data disclosure rather than code execution, the damage is limited to confidentiality compromise but still meaningful for e‑commerce privacy concerns.

The affected product is the WordPress plugin 'Order Splitter for WooCommerce' authored by fahadmahmood. Versions 5.3.5 and earlier are vulnerable; versions newer than 5.3.5 are presumed to contain the fix.

The CVSS score of 4.3 classifies the weakness as Low severity and the EPSS score of less than 1% indicates a very low exploitation probability at present. The flaw is not listed in the CISA KEV catalog. Attackers would need to be authenticated and hold at least a Subscriber role; once authenticated, they can invoke the exposed AJAX endpoint to read other users’ order information. No elevated privileges or special network conditions are required beyond normal authenticated access.