An unauthorized access vulnerability exists in the Rustaurius Order Tracking WordPress plugin up to version 3.4.3. The flaw is a missing authorization check that allows any visitor to retrieve detailed order information. Exposing such data can compromise customer privacy, undermine business confidentiality, and potentially lead to financial damage if the information is misused.

All installations of the Rustaurius Order Tracking plugin with a version number 3.4.3 or earlier are affected. The plugin is widely deployed on WordPress sites that process customer orders. The advisory indicates that newer releases should contain a fix, though no specific patch version is cited.

No publicly listed severity score is available, yet the absence of an access control check suggests a high risk of exploitation. Based on the description, it is inferred that an attacker can reach vulnerable plugin endpoints from anywhere on the web, bypassing authentication to read order data. This could be performed by unauthenticated users or users with limited privileges, exposing sensitive transaction details to anyone who can trigger the flaw.