The Quick View for WooCommerce plugin for WordPress suffers from an information exposure vulnerability (CWE-200) due to inadequate access control on the 'wqv_popup_content' AJAX endpoint. This flaw permits unauthenticated users to retrieve data from private products that should be restricted, potentially leaking sensitive product information. The vulnerability affects all versions up to and including 2.2.17. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, no privileges required, and no user interaction needed. No patch or remediation details have been provided by the vendor or in the advisory.

An unauthenticated attacker can exploit this vulnerability to access sensitive information from private products within the WooCommerce store that should not be publicly accessible. This exposure could lead to unauthorized disclosure of product details, potentially impacting business confidentiality or competitive advantage. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected AJAX endpoint via web application firewall rules or other access control mechanisms to prevent unauthenticated access. Monitor vendor communications for updates on patches or official mitigations.