Order Sync With Zendesk For Woocommerce
Monthly
Unauthenticated information disclosure in the Order Sync with Zendesk for WooCommerce WordPress plugin (all versions before 2.2.3) exposes full customer order history and cumulative purchase totals to any remote attacker who supplies a target's email address. The plugin's REST API endpoint omits both a WordPress capability check and any ownership verification, meaning the access control layer is entirely absent - not misconfigured but simply missing. A publicly available proof-of-concept exists (reported by WPScan), and SSVC assesses the vulnerability as automatable, making bulk enumeration of customer purchase data a realistic threat; however, no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Unauthenticated information disclosure in the Order Sync with Zendesk for WooCommerce WordPress plugin (all versions before 2.2.3) exposes full customer order history and cumulative purchase totals to any remote attacker who supplies a target's email address. The plugin's REST API endpoint omits both a WordPress capability check and any ownership verification, meaning the access control layer is entirely absent - not misconfigured but simply missing. A publicly available proof-of-concept exists (reported by WPScan), and SSVC assesses the vulnerability as automatable, making bulk enumeration of customer purchase data a realistic threat; however, no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.