The Paystack WooCommerce Payment Gateway plugin for WordPress contains a flaw that exposes sensitive user data. An unauthenticated attacker can retrieve customer personally identifiable information such as billing name, email, phone number, addresses, and product lists by passing a 'key' parameter to the order-pay endpoint. This data is present in the page HTML through a localization script and can be accessed by enumerating sequential order identifiers. The vulnerability allows full disclosure of personal data without requiring any credentials.

WordPress sites that use the Paystack WooCommerce Payment Gateway plugin version 5.8.5 or earlier and have enabled the optional custom metadata setting in the gateway configuration. All orders made on such sites are vulnerable to data extraction via the order-pay endpoint.

The vulnerability has a CVSS score of 5.3, indicating moderate impact. No EPSS score is available, and the issue is not listed in CISA KEV. Attackers only need to know a valid order ID and can access the sensitive data without authenticating, making exploitation straightforward. Since the flaw relies on simple HTTP request construction, it can be automated. The risk is therefore moderate, but the potential damage from PII theft is significant.