CVE-2024-1492 is an improper access control vulnerability (CWE-284) in the WPify Woo Czech plugin for WordPress. The vulnerability arises from a missing capability check in the maybe_send_to_packeta function, enabling unauthenticated attackers to retrieve shipping information for orders by supplying a known order number. This issue affects all versions up to and including 4.0.8. The CVSS v3.1 base score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and only confidentiality impact.

An attacker without authentication can obtain shipping details of orders if the order number is known, potentially exposing sensitive customer shipping information. There is no impact on data integrity or system availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to order numbers and monitor for unauthorized access attempts. Avoid exposing order numbers publicly or in URLs. Follow vendor updates for patch releases.