The vulnerability is a missing authorization check that permits any user – even those who are not logged in – to use the preview_order parameter in the Email Templates Customizer and Designer plugin. An attacker can first harvest a reusable nonce from the 302 location header returned by an unguarded admin_init handler, then combine that nonce with an arbitrary WooCommerce order ID to retrieve the full order preview. The preview displays sensitive customer data such as the billing name, address, phone number, and email address, allowing unauthenticated disclosure of personally identifiable information. This is a classic authorization bypass, identified as CWE‑862, that directly compromises confidentiality for all orders processed by the site.

WordPress sites that use the Email Templates Customizer and Designer plugin from the vendor saadiqbal, for all releases up to and including version 1.5.14. The issue is localized to the plugin’s order‑preview functionality and affects any deployment that enables WooCommerce order management.

With a CVSS score of 7.5 the flaw represents a high‑severity information‑disclosure risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been widely exploited. Nevertheless, the attack is trivial to perform – two unauthenticated HTTP requests with no special privileges – and can be carried out remotely by any web user. The lack of a proper authorization check means the risk is systemic to every order on the site, rendering the vulnerability a high‑value target for attackers.