The WPC Order Tip for WooCommerce WordPress plugin before version 3.3.1 does not implement proper authorization or nonce verification in one of its reporting features. This security weakness enables unauthenticated attackers to retrieve sensitive customer order data including billing names, order IDs, order statuses, fee amounts, and order dates. The vulnerability is classified as CWE-200 (Information Exposure) and has a CVSS 3.1 base score of 7.5, indicating high severity. There is no vendor advisory or patch information available at this time, and no known exploits have been reported in the wild.

Unauthenticated attackers can access sensitive order-related information of any customer in the affected WooCommerce store. This exposure compromises customer privacy and could facilitate further targeted attacks or fraud. The vulnerability does not affect integrity or availability but results in a high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the reporting features or disable the vulnerable plugin if possible to prevent unauthorized data exposure.