What the vulnerability does
01Description
The Woocommerce Automatic Order Printing | ( Formerly WooCommerce Google Cloud Print) plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1 via the xc_woo_printer_preview AJAX action due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Subscriber-level access and above, to view other user's invoices and orders which can contain sensitive information.
Explanation of Vulnerability in Simple Terms
02Summary
The WooCommerce Automatic Order Printing plugin through version 4.1 contains an authorization flaw that allows authenticated users with low privileges to access sensitive order information they should not be able to view. The vulnerability requires a valid user account but no special interaction. Site administrators should update the plugin immediately to prevent unauthorized disclosure of customer order data.
What an attacker can do
03Attacker Capabilities
Read order data belonging to other customers or users without authorization.
Potential impact on your site
04Site Impact
Customer order information may be exposed to unauthorized users, risking privacy violations and potential compliance issues.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low-level privileges on the site.
Key dates
06Disclosure timeline
April 24, 2025
CVE published
April 8, 2026
Record updated
