This vulnerability in the WooCommerce Order Details plugin by vanquish is caused by missing authorization checks, which leads to incorrect access control. Specifically, it allows an attacker to access order details without proper permissions. The affected versions include all versions up to and including 3.1. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates the vulnerability is remotely exploitable over the network with low attack complexity, no privileges, and no user interaction required, resulting in high confidentiality impact but no integrity or availability impact. There is no vendor advisory or patch information provided, so remediation status is unknown.

An attacker can remotely access sensitive order details without authorization, potentially exposing confidential customer information. The vulnerability does not impact data integrity or availability but poses a high confidentiality risk. No known exploits have been observed in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WooCommerce Order Details plugin and monitor for unusual access patterns. Avoid exposing the affected plugin to untrusted networks where possible.