The Biteship WooCommerce Shipping plugin contains an Insecure Direct Object Reference in the get_order_detail function. The function exposes order information through a key that is controlled by the requester, and no validation ensures that key belongs to the authenticated user. As a result, any authenticated user with Subscriber level access or higher can request and view other users' order details. The flaw allows disclosure of private order data without modifying system state, and is classified as CWE-862.

The vulnerability affects the Biteship Shipping plugin for WooCommerce, all releases up to and including version 3.2.0. Users running any of these versions on a WordPress site are impacted.

The CVSS score of 4.3 indicates a medium impact. The EPSS is below 1%, suggesting a low likelihood of exploitation as of the current data. The issue is not listed in CISA KEV. Exploitation requires the attacker to be authenticated – a WordPress user with the Subscriber role or higher – and to access the order tracking endpoint exposed by the plugin. Once the attacker sends a request with a forged order key, the plugin will return the target order details. Because the vulnerability relies on an authenticated session, attacks typically occur from compromised user accounts or from malicious users who obtain legitimate credentials. The lack of safeguards and the low EPSS score imply that this vulnerability may be underused but still poses a real threat to confidentiality for sites where all registered users can log in.