The vulnerability originates from a missing capability check in the Product Delivery Date for WooCommerce plugin before version 3.3.2. When an authenticated user with a Contributor role requests the calendar view via AJAX, the plugin returns order details belonging to other users. This results in accidental disclosure of order information, giving low‑privileged users access to sensitive customer data. The flaw is an access‑control insufficiency, classified as CWE‑200.

Any WordPress installation using the Product Delivery Date for WooCommerce plugin version 3.3.1 or earlier is affected. Sites that use WooCommerce and have this plugin deployed are at risk if contributors are present.

The flaw does not require any special technical skill beyond logging in as a Contributor. Once authenticated, a user can trigger the AJAX endpoint and retrieve others' order details. Although the EPSS score is < 1%, the absence from KEV suggests no known widespread exploitation yet, but the impact on confidentiality is significant. The CVSS score of 2.7 indicates low severity.