The WPC Order Tip for WooCommerce plugin prior to version 3.3.1 contains a CWE-200 information exposure vulnerability due to missing authorization and nonce verification in a reporting feature. This security gap enables unauthenticated users to retrieve sensitive customer order information such as billing names, order identifiers, order statuses, fee amounts, and order dates without proper access controls.

Unauthenticated attackers can access sensitive customer order data from the affected WooCommerce stores. This exposure of personally identifiable information and order details can lead to privacy violations and potential misuse of customer data. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the reporting features of the plugin and monitor for updates from the vendor. Avoid exposing the vulnerable reporting functionality to unauthenticated users.