The vulnerability arises from a missing authorization check in FunnelKit <= 3.16.0.6 when processing the 'order_id' or 'order' POST parameters. This flaw allows an unauthenticated user to pull billing personally identifying information – full name, street address, email, phone – for any WooCommerce order by guessing or enumerating sequential order IDs. This leads to a disclosure of sensitive user data and violates privacy expectations.

The affected product is Team FunnelKit's FunnelBuilder – Funnel Builder Plugin for WooCommerce Checkout. All releases up to and including 3.16.0.6 are vulnerable. Sites that install this plugin and expose thank‑you pages rendering the [wfty_order_meta] or [wfty_order_total] shortcodes are impacted.

The CVSS score is 7.5, indicating a high severity. EPSS data is unavailable and the CVE is not listed in the CISA KEV catalog. Exploitation requires an active site with the plugin’s thank‑you page in place; the attacker sends a POST request containing an 'order_id' value and the plugin returns the order’s billing fields. Because no authentication is required and the input can be enumerated, the risk of widespread disclosure is significant on affected e‑commerce sites.