The FunnelKit Payment Gateway for Stripe WooCommerce plugin for WordPress contains an Insecure Direct Object Reference that allows an unauthenticated attacker to read the full billing personal identifiable information—name, e‑mail, phone, and street address—associated with any order. This occurs because the plugin's wp_localize_script call emits the fkwcs_data JavaScript object on each /checkout/order-pay/<ID>/ page without checking that the requester is authorized or that the order ID belongs to the user. Even when WooCommerce rejects the order‑pay request, the script runs and leaks the customer data. The weakness reflects CWE‑639, where a missing permission check permits data disclosure.

All WordPress sites that use the FunnelKit Payment Gateway for Stripe WooCommerce plugin, any version up to and including 1.15.0.2, are affected. The flaw exists in the plugin’s core code for the order‑pay route; it does not affect other WooCommerce components directly, but any store that relies on this plugin for Stripe payments is at risk. Sites running newer releases of the plugin are not known to be vulnerable as the issue has been fixed in versions after 1.15.0.2.

The CVSS score of 7.5 indicates a high severity, combining high confidentiality impact with a relatively high attack complexity and network exploitation vector. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the flaw allows remote unauthenticated users to enumerate sequential order IDs and view sensitive data from any order. The vulnerability is not listed in CISA's KEV catalog, suggesting that no widespread known exploitation exists as of this assessment. Nevertheless, because the data exposure involves customer billing information, the risk to affected merchants is significant. An attacker only needs to request the /checkout/order-pay/<ID>/ URL for sequential or guessed order IDs; no authentication or special privileges are required.