The vulnerability in the WooCommerce Automatic Order Printing plugin is an insecure direct object reference that occurs when the xc_woo_printer_preview AJAX action lacks validation of a user‑controlled key. An attacker with Subscriber or higher privileges can exploit this flaw to view other users’ invoices and orders, exposing potentially sensitive information. This weakness is identified as CWE-639, representing unauthorized viewing of resources.

The affected product is the WooCommerce Automatic Order Printing plugin (formerly WooCommerce Google Cloud Print) for WordPress, distributed by xpertsclub. All released versions up to and including 4.1 are vulnerable, and any site running those versions exposes order data to authenticated users with Subscriber role or higher.

The CVSS score of 4.3 places the flaw in the medium severity range. The EPSS score of less than 1% indicates a very low probability that the vulnerability will be exploited in the near term, and it is not listed in the CISA KEV catalog. The attack likely requires an authenticated WordPress user with Subscriber‑level access or higher to trigger the insecure AJAX action, after which the attacker can retrieve invoice details belonging to other users. Deploying a fix or access controls is therefore advisable to prevent accidental disclosure.