The CodeAtoZ B2B Suite for WooCommerce plugin fails to enforce access control on guest requests for quotes. An attacker can request the URL for a quote by supplying an enumerable identifier and receive the full quote, which contains the buyer’s name, email address, and the requested line items. This results in a privacy breach that exposes sensitive customer data without the need for authentication.

All WordPress sites that have the CodeAtoZ B2B Suite for WooCommerce plugin installed in a version earlier than 1.6.1 are affected. The vendor information is not formally listed, but the product belongs to the CodeAtoZ suite for WooCommerce. Any site running a pre‑1.6.1 instance is vulnerable if the plugin’s guest quote endpoint is enabled.

The vulnerability is exploitable via a simple HTTP request that does not require authentication. Because the quote identifiers are sequential, an attacker can enumerate through them to extract multiple quotes. The EPSS score of less than 1% indicates a low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. The CVSS base score is 5.3, which reflects a moderate risk level. Nonetheless, the exposure of customer personal data and order details can have significant business impact.