The Klamra Paycal for Aspaclaria plugin for WordPress contains an insecure direct object reference that allows authenticated users with subscriber or higher privileges to download any customer invoice by specifying an arbitrary 'invoice_id'. This flaw permits attackers to see sensitive billing personal data such as full names, email addresses, phone numbers, order totals, line items and customer notes of other customers. The vulnerability arises from a missing server‑side check on the object identifier, exposing PII in the downloaded invoices.

Vulnerable installations are those running any version of the Klamra Paycal for Aspaclaria plugin up to and including 1.1.4 on WordPress. The affected component is the download functionality that accepts an 'invoice_id' parameter.

The flaw carries a CVSS score of 4.3, indicating a moderate risk level. Because the attack requires an authenticated WordPress session with subscriber‑level access, attackers must first compromise or legitimately obtain site credentials. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. No public exploits are reported, but the attack surface is exposed to any authenticated user on the site, making it a potential internal threat.