WooCommerce CVE-2025-15033

Requires an authenticated low-privilege account (PR:L - a registered logged-in customer), and the target site must be running one of the affected WooCommerce versions (8.1 through 10.4.2) in a specific but source-unspecified configuration ('sites with a certain configuration'). Limiting factors: exploitation is impossible without a valid customer login, is confined to installations in that particular configuration (not all WooCommerce sites are affected in practice), and does not apply to WooCommerce 8.0 or earlier or to patched releases (8.1.3+, …, 10.4.3). The exact configuration toggle is not disclosed in the available data and should be confirmed with the vendor advisory.

This is a moderate-severity information disclosure (CWE-200) with aligned, internally-consistent signals that point to a real but non-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N = 6.5) indicates a network-reachable flaw exploitable by a low-privileged authenticated user (PR:L, i.e. any logged-in customer) with no user interaction, yielding high confidentiality impact but no integrity or availability impact - consistent with an authorization/IDOR-style leak of guest order data. The EPSS score is low (0.33%, 25th percentile), there is no CISA KEV listing, and no public exploit code is referenced, so there is no evidence of active or imminent mass exploitation. The one tempering nuance: the description scopes the flaw to 'sites with a certain configuration,' which the generic AV:N/AC:L vector does not capture - the specific configuration prerequisite is not detailed by the source, so real-world exploitability may be narrower than the base score implies. Net: a legitimate privacy/data-exposure bug worth patching on normal cadence, not an emergency; the PR:L requirement and configuration dependency meaningfully reduce the realistic attack surface versus a true unauthenticated leak.

An attacker registers or uses an existing low-privilege customer account on a vulnerable WooCommerce store (8.1-10.4.2) running the affected configuration, then issues authenticated requests to order-data endpoints and receives order details belonging to guest (non-account) customers they should not be able to see. No public exploit code is identified, and no user interaction or elevated privileges beyond a standard logged-in customer are required.