The Order Sync with Zendesk for WooCommerce plugin prior to 2.2.3 does not perform capability checks for a REST API endpoint and does not verify that the requester owns the queried account. An unauthenticated attacker can retrieve the order history and purchase totals of any customer whose email address is known or enumerated. The vulnerability results in a confidentiality breach, exposing sensitive customer order information.

The vulnerability affects the WordPress plugin Order Sync with Zendesk for WooCommerce in all versions earlier than 2.2.3. The plugin is used on e‑commerce sites that integrate WooCommerce orders with Zendesk. Users running any of these earlier releases are exposed.

Based on the description, it is inferred that the attack vector is a direct, unauthenticated HTTP request to the vulnerable REST API endpoint exposed by the plugin. Because authentication is bypassed entirely, the attack surface is broad; any user with network access to the site can issue the request and view the order data. The CVSS score is 5.3, indicating moderate severity. EPSS score is <1% and the CVE is not listed in KEV, but the straightforward exploitation path—composing a direct API request with a target email—indicates a moderate probable exploitation risk if an attacker can discover customer emails through other means. The risk remains significant until the plugin is updated or the endpoint is otherwise secured.