The PeachPay plugin for WooCommerce fails to perform an access control check before returning a secret order key in response to an unauthenticated request. Once the key is obtained, an attacker can retrieve the customer’s name, email address, postal address, and order contents, resulting in a direct breach of confidentiality for any paid order.

WordPress sites that have installed PeachPay versions earlier than 1.120.70, regardless of the specific payment processor integrated. The vulnerability is specific to the plugin’s ConvesioPay BTCPay status check functionality, which is shipped with all versions from 1.117.9 through 1.120.69.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating that no public exploitation is currently documented and the overall exploitation probability is uncertain. Nevertheless, the flaw is an uncomplicated privilege‑bypass that allows an attacker to retrieve sensitive customer data through a simple unauthenticated HTTP request, a likely attack vector that requires only knowledge of an existing order identifier. The severity could be high due to the sensitive nature of the disclosed information, even though the CVSS score is not supplied.