The PeproDev WooCommerce Receipt Uploader plugin for WordPress before version 2.8.0 does not validate that a requested image attachment matches the order referenced by its access token. This omission creates an Insecure Direct Object Reference (IDOR) that allows an unauthenticated attacker to forge a token and retrieve image files, including other customers’ payment receipts and potentially other sensitive uploads. The primary consequence is the loss of confidentiality for customer transaction data.

All installations of the PeproDev WooCommerce Receipt Uploader plugin up through version 2.8.0 are impacted. The plugin is a WordPress extension that attaches receipt images to WooCommerce orders; no specific patch level is listed, so any release prior to 2.8.1 should be considered vulnerable.

The vulnerability is unauthenticated and requires only the ability to construct an HTTP request with a forged token, making it straightforward for an attacker to exploit. The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1 % suggests that exploitation is unlikely but not impossible. It is not listed in the CISA KEV catalog. Attackers can directly request the receipt endpoint with a crafted token, bypassing access controls and exposing sensitive customer images.