The vulnerability occurs because the WordPress payment plugin fails to verify that the user requesting an order's receipt URL is authorized. An attacker can supply any order id and receive the order-received page, which includes a secret key used to confirm the order. This disclosure can allow the attacker to enumerate all orders, learn the secret key and access sensitive customer information such as name, email, phone number and address. The result is unauthorized disclosure of personal data.

Any site running UniPAY Payment Gateway For WooCommerce before version 2.4 is vulnerable. This is a WordPress extension that provides a payment gateway for WooCommerce. Users of the plugin should check the installed version and confirm whether updates to 2.4 or later have been applied.

Exploitation requires only knowledge of the order id, and the code delivers the key without checking authentication, so an unauthenticated attacker can enumerate orders by trial and error. Because the flaw leaks sensitive data rather than enabling code execution, the exposure risk lies primarily in privacy and potential fraud. None of the standard public metrics such as EPSS are available, and the vulnerability is not listed in the CISA KEV catalog, so recent attack activity is unknown. Nonetheless, the vulnerability poses a moderate to high privacy risk for sites that handle customer payment data, and the CVSS score is not provided in the advisories.