This vulnerability in vanquish WooCommerce Order Details (<= 3.1) arises from missing authorization checks, which leads to incorrect access control. An attacker can exploit this flaw remotely without authentication or user interaction to access sensitive order information. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact with no integrity or availability impact. No patch or vendor advisory is currently provided, and the plugin is not a cloud service.

Exploitation of this vulnerability could result in unauthorized disclosure of sensitive order details managed by the WooCommerce Order Details plugin. Since the vulnerability requires no privileges or user interaction, it poses a high risk to confidentiality of customer and order data. There is no impact on integrity or availability reported. No known exploits are currently active in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for unusual access patterns. Avoid exposing the plugin interfaces to untrusted networks if possible.