The Quick View for WooCommerce plugin is vulnerable to information exposure, allowing attackers who are not authenticated to retrieve details about private products. The flaw resides in the wqv_popup_content AJAX endpoint, which does not restrict visibility of private products. Affected data can include product titles, descriptions, prices, and any other metadata exposed through the endpoint, leading to unwanted disclosure of sensitive e‑commerce information.

The vulnerability affects the Quick View for WooCommerce plugin developed by shapedplugin. All plugin versions up to and including 2.2.17 are impacted. Versions newer than 2.2.17 are not reported as vulnerable.

The CVSS score of 5.3 indicates a medium severity. The EPSS score of less than 1% suggests a low probability of exploitation. The issue is not listed in the CISA KEV catalog. Attackers can exploit the flaw by sending unauthenticated requests to the wqv_popup_content endpoint, which returns private product data without enforcing access control.