The WP Helper Premium WordPress plugin before version 4.7.6 fails to verify an order key when rendering a custom order confirmation page or when processing related Ajax actions, enabling unauthenticated users to access detailed order information and modify the status of arbitrary orders. This flaw results in the disclosure of personal customer data and the potential alteration of order states, compromising both confidentiality and integrity of transactional data.

The vulnerability affects installations of the WP Helper Premium plugin where the optional order confirmation page module is enabled and WooCommerce is active. The flaw applies to all plugin versions prior to 4.7.6; no specific patch version list is provided. Site administrators should verify the plugin version and confirm that WooCommerce is present.

Because the flaw is exploitable without authentication and requires only that WooCommerce and the order confirmation module be active, the risk level is high. The CVSS score of 8.2 reflects a severe threat, while the EPSS score of <1% indicates a low probability of exploitation; the vulnerability is not currently listed in CISA’s KEV catalog. The likely attack vector is unauthenticated external access to order confirmation URLs or Ajax endpoints; based on the description, it is inferred that remote, web-based exploitation is possible with no special privileges.