Faktur Pro CVE-2026-32576

Exploitation requires an authenticated WooCommerce customer account (CVSS PR:L) on a site running the Faktur Pro for WooCommerce plugin at version 3.2.1 or earlier; the attacker then supplies another user's object identifier (e.g. invoice/order ID) to a request that fails to enforce per-user ownership checks. No user interaction (UI:N) and no special non-default configuration are indicated beyond having the vulnerable plugin active. The primary limiting factor is the authentication requirement - anonymous visitors cannot exploit it - combined with the plugin's niche deployment; impact is bounded to disclosure of other customers' invoice/order data (no write or availability impact).

This is a moderate-risk authorization flaw whose CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the real-world threat rather than overstating it. The vector shows network-reachable, low-complexity exploitation but requires low-level privileges (PR:L), meaning an attacker needs an authenticated account - consistent with the description's framing as a 'Customer' IDOR, i.e. any registered WooCommerce customer. Impact is confidentiality-only (C:H, I:N, A:N): an attacker can read other users' objects (invoices/order data) but cannot modify or disrupt. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation; this reads as a low-urgency patch-on-schedule issue rather than an emergency. One signal to verify: the input tag 'Authentication Bypass' conflicts with the CWE-639 classification and the IDOR description - IDOR is a broken-authorization (not authentication-bypass) weakness, and the PR:L vector confirms authentication is still required, so the 'bypass' label should not be read as pre-auth access.

A low-privileged attacker registers or uses an existing WooCommerce customer account on a site running Faktur Pro for WooCommerce ≤ 3.2.1, then manipulates an object identifier (such as an invoice or order ID) in a request to retrieve invoice/order documents belonging to other customers. Because the flaw exposes confidentiality only, the attacker harvests other customers' personal and billing data but cannot alter or delete records. No public exploit code is identified at time of analysis, though the low attack complexity makes manual enumeration straightforward.