The WhatsOrder – Instant Checkout for WooCommerce plugin allows unauthenticated attackers to access customer invoices that contain personally identifiable information, such as names, email addresses, phone numbers, billing addresses, purchase details, coupons, shipping methods, and totals. By enumerating sequential order identifiers the attacker can download the invoice HTML files that are saved to wp-content/uploads/whatsorder_invoices/, which is publicly accessible because the directory lacks security controls. The exposed data can be used for phishing, fraud, or identity theft.

The vulnerability affects the Yapacdev WhatsOrder plugin for WooCommerce in all released versions up to and including 1.0.1. WordPress sites that have this plugin installed and use the default invoice generation path are at risk. No specific operating system or PHP version constraints are stated.

The CVSS base score of 5.3 indicates a moderate severity, mainly due to the absence of authentication requirements. Because the attack vector is via simple HTTP requests to publicly accessible URLs, the likelihood of exploitation is considerable for any site exposing the invoices. EPSS is not available, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. An attacker does not need local credentials and can enumerate order IDs to trigger the flaw. The consequence is total loss of confidential customer data and potential regulatory non‑compliance.