Woocommerce Automatic Order Printing Insecure Direct Object Reference Vulnerability

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the Woocommerce Automatic Order Printing plugin for WordPress, in all versions through 4.1. The issue arises in the xc_woo_printer_preview AJAX action, where a user-controlled key lacks proper validation. This vulnerability enables authenticated attackers with Subscriber-level access and above to access and view invoices and orders belonging to other users, potentially exposing sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to and disclosure of order and invoice information from other users, including sensitive details.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.