This CVE exposes a common but often underestimated vulnerability class: unauthenticated REST endpoints in WordPress plugins that inadvertently surface competitive intelligence. The Gutenberg Essential Blocks plugin exposed WooCommerce per-product sales metrics through a publicly accessible REST route—no authentication required, no capability check, no rate limiting. While individual product sales counts sometimes appear on storefront pages, the vulnerability transforms this from a single data point into bulk reconnaissance: an attacker can enumerate your entire catalog's sales velocity in seconds, mapping which products are bestsellers, identifying seasonal patterns, and inferring pricing strategy adjustments. That's competitive intelligence with real market value, which is why the CVSS 7.5 is appropriate—the severity isn't in the individual number, it's in programmatic access to all numbers.
The likely root cause is simple: a developer added the endpoint to support an editor feature (bestseller badges, analytics widgets) and grabbed everything WooCommerce's API made available. The fix was probably minimal—removing the sales metric from the response while leaving the endpoint public—because the developer likely didn't recognize the data as sensitive. This isn't malicious; it's entropy. The endpoint drifted into production, the original rationale was forgotten, but the exposure remained.
Check your WooCommerce-adjacent plugins now: any REST route registered without a permission_callback is publicly accessible. That's WordPress 101, but it's remarkably easy to overlook when you're grabbing data for what feels like an internal feature. Review your active installs for unauthenticated endpoints exposing product, order, or customer data—particularly endpoints that aggregate information across your catalog. The real severity isn't the CVSS score; it's the duration of exposure across your install base.