CVE-2025-12955 identifies a missing authorization vulnerability in the getOrders function of the PiWeb Live sales notification plugin for WooCommerce. The function lacks proper authorization and capability checks when displaying recent order information, enabling unauthenticated attackers to retrieve sensitive customer information. This vulnerability affects all versions up to and including 2.3.39. The CVSS 3.1 base score is 7.5, reflecting a network attack vector with no privileges required and no user interaction, resulting in high confidentiality impact but no integrity or availability impact. No official patch or remediation guidance is currently available from the vendor.

An attacker without authentication can extract sensitive customer information including buyer first names, city, state, country, purchase time and date, and product details. This exposure compromises customer privacy and could facilitate further targeted attacks or fraud. There is no indication of impact on data integrity or system availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the plugin or restricting access to the functionality that displays recent order information to trusted users only. Monitor vendor communications for updates regarding patches or official mitigations.