Description

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders. Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.2",
  "pubDate": "2026-08-13T06:17:38.120Z",
  "pubdate": "2026-08-13T06:17:38.120Z",
  "executiveSummary": "An Insecure Direct Object Reference (IDOR) vulnerability exists in the WP Helper Premium WordPress plugin before version 4.7.6, specifically within its custom order confirmation page module and related AJAX actions. The vulnerability allows unauthenticated remote attackers to bypass authorization controls and access sensitive order details belonging to arbitrary customers, as well as modify the state of arbitrary orders. The risk implications are severe, encompassing widespread Personally Identifiable Information (PII) exposure, potential privacy violations, and unauthorized transaction manipulation. Successful exploitation requires WooCommerce to be active on the WordPress instance and the vulnerable plugin's optional order confirmation page module to be explicitly enabled. Attackers do not require any authentication credentials or elevated privileges to execute the attack, relying solely on interacting with the unverified order key parameter handling mechanisms exposed over the network.",
  "technicalDetails": "The root cause of the vulnerability stems from insufficient access control enforcement and a lack of cryptographic or session-based verification of the order key when rendering the custom order confirmation page or processing related AJAX requests. The vulnerable component resides within the optional order confirmation page module of the WP Helper Premium WordPress plugin affecting versions prior to 4.7.6. Due to the absence of proper authorization checks, the application fails to validate whether the requesting unauthenticated user is legitimately associated with the requested order identifier.\nThe attack flow proceeds as follows: An unauthenticated attacker identifies that the application accepts order keys or identifiers via HTTP requests directed at the custom order confirmation page or the corresponding AJAX endpoints. Because the plugin does not verify the authenticity or ownership of the provided order key, the attacker can systematically or arbitrarily enumerate and manipulate these parameters. By supplying target order keys within the request, the application directly processes the input and returns detailed order information belonging to other customers without requiring authentication or session validation.\nFurthermore, the lack of input validation and state verification extends to the AJAX actions handled by the vulnerable module. Attackers can leverage these endpoints not only to read sensitive customer data, including personal information contained within the order records, but also to alter the state of arbitrary orders within the WooCommerce database. The network exposure is public-facing via HTTP/HTTPS, enabling remote exploitation over the internet. The post-exploitation impact includes severe data confidentiality and integrity breaches, allowing unauthorized actors to harvest PII and manipulate e-commerce transaction workflows."
}