The Woocommerce Automatic Order Printing plugin for WordPress suffers from an authorization bypass vulnerability (CWE-639) in all versions up to and including 4.1. The vulnerability arises from missing validation on a user-controlled key in the xc_woo_printer_preview AJAX action, allowing authenticated users with Subscriber-level privileges or higher to access other users' order and invoice data. This constitutes an insecure direct object reference (IDOR) vulnerability. The CVSS 3.1 base score is 4.3, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges. A patch is available to remediate this vulnerability.

An attacker with at least Subscriber-level access can exploit this vulnerability to view invoices and orders belonging to other users. These documents may contain sensitive information, potentially leading to privacy breaches. There is no indication of impact on data integrity or availability. No known exploits in the wild have been reported.

A patch is available for this vulnerability and should be applied promptly to prevent unauthorized access to user order and invoice data. Since this is a plugin vulnerability affecting self-hosted WordPress instances, site administrators must update the Woocommerce Automatic Order Printing plugin to a fixed version. No additional mitigation steps are indicated by the vendor advisory.