Waynboot‑mall version 2.0.0 contains an insecure direct object reference vulnerability in its mobile order API endpoints. The flaw allows an authenticated member to supply any order identifier—by guessing or enumerating sequential IDs—to retrieve, cancel, confirm, delete, or refund another member's order. This results in disclosure of recipient addresses and phone numbers and the ability to disrupt the order lifecycle, violating confidentiality and integrity for user data. The weakness matches CWE‑639.

The vulnerability affects installations of Waynboot‑mall version 2.0.0 from vendor wayn111. All deployments that expose the mobile order endpoints—including the order controller and mobile order service—are susceptible. Earlier releases prior to 2.0.0 are not affected, and versions following the fix are assumed secure.

The CVSS score of 5.3 indicates moderate severity. No EPSS figure is available, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. The attack requires authenticated API access and knowledge of or ability to enumerate valid order identifiers. Attackers can easily enumerate sequential IDs, making the vulnerability likely exploitable in practice against any user that can present a valid authentication token.