The Antom Payments WordPress plugin version 2.0.11 and earlier fails to enforce any ownership or authorization checks before it returns an order‑confirmation link. The returned link contains a private key, and the plugin’s response exposes sensitive order data—customer name, address, phone, and email—to any unauthenticated visitor. This breach enables attackers to retrieve confidential personal information without needing credentials, leading to privacy violations and the potential for phishing or fraud.

This vulnerability affects the Antom Payments plugin for WordPress deployed on sites using WooCommerce. All installations of the plugin through version 2.0.11 are impacted; newer versions (post‑2.0.11) are not listed as affected.

No CVSS or EPSS score has been published for this issue, and it is not listed in the CISA KEV catalog, suggesting that no public exploits are documented. Nevertheless, the vulnerability is trivially exploitable by unauthenticated users simply by navigating to any order‑confirmation URL. Because the affected data includes personally identifying information, the potential harm is high, and attackers could harvest large amounts of sensitive customer data if the site hosts multiple orders.