The vulnerability occurs in the ShopApper WordPress plugin version 0.4.62 and earlier when a REST endpoint fails to verify ownership of the requested customer profile. An attacker who is merely authenticated, such as any logged‑in customer or subscriber, can request and receive personal data of other users, including email addresses, names and roles. This flaw enables direct access to confidential user information without authorization, compromising privacy and potentially enabling further attacks such as phishing or credential reuse. The weakness is a classic Insecure Direct Object Reference, allowing an authenticated user to enumerate or retrieve data belonging to other accounts.

The affected product is the Mobile App for WooCommerce: ShopApper Mobile App Builder Service plugin for WordPress. Versions up to and including 0.4.62 are vulnerable; newer releases contain the fix. Any installation of the plugin on a WordPress site that exposes the affected REST API endpoints to logged‑in users is at risk.

Because the attacker requires only authentication and no additional privileges, the attack vector is relatively simple and scalable within the customer base of the WooCommerce store. No exploit code is referenced in the public advisory, but the flaw’s design enables automatic enumeration of user data. RFC severity metrics are not available, but the confidentiality impact is clear. Without a patch, any user with legitimate access to the store’s backend could harvest personal data of all customers. The vulnerability is not yet listed in the CISA KEV catalog, and no EPSS score is present, indicating that exploitation has not been observed publicly yet, but the potential exists.