The WooCommerce Orders & Customers Exporter plugin contains a missing authorization check that allows any authenticated user to trigger the export of all orders and customer data, leading to potential leakage of sensitive customer information. This broken access control confines the vulnerability to CWE-862 and can compromise confidentiality by exposing personal and transactional data.

The vulnerability affects the WooCommerce Orders & Customers Exporter plugin by vanquish, all versions up to and including 5.4, across all builds from the earliest release to 5.4. Any WordPress site running an affected version is therefore exposed until a version that includes the authorization fix is deployed.

With a CVSS score of 6.5, the issue has a moderate severity. The EPSS score of less than 1% suggests a low probability of immediate exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be remote exploitation via the plugin’s export endpoint, potentially accessible to users with any authentication level, enabling an adversary to extract customer data without elevated privileges.