The Payconiq WordPress plugin fails to verify that a visitor is authorized to view an order before providing the confirmation link. As a result, unauthenticated users can retrieve any paid order’s key and, for recent guest orders, access the customer’s personal details. This flaw allows a malicious actor to obtain confidential transaction information and potentially sensitive personal data, compromising confidentiality and privacy.

WordPress sites running the Payconiq for WooCommerce plugin at versions 1.0.4 or earlier are impacted. The vulnerability applies to all users of the plugin, regardless of whether the orders were made by logged‑in customers or guests.

No EPSS score is available and the issue is not listed in CISA’s KEV catalog, but the lack of an authentication check means the flaw can be exploited by any Internet user via simple web requests. The attack vector is unauthenticated HTTP(S) access to the order‑confirmation endpoint. While there are no known public exploits yet, the vulnerability poses a high risk of confidential data exposure and could be leveraged to harvest order data at scale.