The WPC Smart Quick View for WooCommerce plugin suffers from an authorization bypass vulnerability (CWE-639) in its 'woosq_quickview' AJAX endpoint. This flaw allows unauthenticated attackers to retrieve data from posts that should be restricted, including password protected, private, or draft products. The root cause is insufficient restrictions on which posts can be included in the AJAX response. The vulnerability affects all versions up to and including 4.2.5. The CVSS 3.1 score is 5.3, reflecting a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality only. No patch or vendor advisory is currently available, and no exploits are known in the wild.

An attacker can extract sensitive information from protected or private WooCommerce product posts without authentication. This results in unauthorized disclosure of potentially sensitive product data. There is no impact on integrity or availability reported. The vulnerability could lead to information exposure but does not allow modification or disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the affected AJAX endpoint via web application firewall rules or other access controls to prevent unauthenticated requests. Monitor vendor channels for updates and apply patches promptly once released.