The MStore API WordPress plugin, prior to version 4.21.0, fails to restrict access to its vendor-orders endpoint. Any authenticated user, including those with Subscriber role, can retrieve all WooCommerce orders and the associated customer personal information. This constitutes an IDOR flaw that exposes sensitive data to unauthorized personnel, resulting in a confidentiality compromise.

Affected systems include the MStore API plugin for WordPress. All releases of the plugin earlier than version 4.21.0 are vulnerable; the issue pertains specifically to the vendor-orders endpoint exposed by the plugin in conjunction with WooCommerce orders.

The vulnerability is exploitable by any authenticated user, meaning the attack surface is effectively the entire user base that can log into the site. Although the EPSS score is not available and the vulnerability is not listed in CISA KEV, the sheer breadth of potential data exposure makes the risk severe. No official exploit is known, but the access control flaw could be leveraged by attackers with legitimate credentials or via social engineering to breach customer confidentiality.