The MStore API WordPress plugin, prior to version 4.21.0, fails to restrict access to its vendor-orders endpoint. Any authenticated user, including those with Subscriber role, can retrieve all WooCommerce orders and the associated customer personal information. This constitutes an IDOR flaw that exposes sensitive data to unauthorized personnel, resulting in a confidentiality compromise. The violation involves improper access control and improper authorization (CWE-639).

Affected systems include the MStore API plugin for WordPress. All releases of the plugin earlier than version 4.21.0 are vulnerable; the issue pertains specifically to the vendor-orders endpoint exposed by the plugin in conjunction with WooCommerce orders.

The vulnerability is exploitable by any authenticated user, meaning the attack surface is effectively the entire user base that can log into the site. The CVSS score of 6.5 indicates medium severity, while the EPSS score is <1% and the vulnerability is not listed in CISA KEV. The flaw involves improper access control and improper authorization (CWE-639), and although no official exploit is known, attackers with legitimate credentials or via social engineering could leverage the access control issue to breach customer confidentiality.