The CVSS 5.3 rating for this WooCommerce loyalty plugin endpoint fundamentally misreads the actual threat landscape. The vulnerability exposes a phone-number-to-profile lookup that returns verified name, email, and loyalty balance — and the severity score treats this as moderate confidentiality loss when the real risk is a high-value reconnaissance pipeline.
Phone numbers are not secrets. They circulate freely through business cards, LinkedIn, social media, and dozens of data broker databases. Unlike a password or even an email address alone, a phone number here is a pre-packaged authentication key: the attacker already has it, and the endpoint confirms the linkage to a full personal profile. The loyalty balance itself signals spending habits — 'I see you spend $400/month here' — which enables targeted social engineering that generic phishing cannot achieve. CVSS models confidentiality as if data is either exposed or sealed; it misses the case where the data was already loosely held elsewhere and this endpoint simply removes the last friction point.
But the most dangerous aspect is what the framework doesn't measure at all: this endpoint functions as a verification service for pre-compiled dossiers that already exist in the broader data ecosystem. Data brokers have spent years cross-referencing phone numbers with purchasing behavior. An attacker doesn't need to correlate datasets — they've outsourced that work. The verification is instant, authenticated only by knowledge of the number itself, which is trivially discoverable.
Worse, the EPSS score of 0.00257 creates false reassurance. This plugin appears to be version 1.0.0 — likely abandoned client work, shipped and forgotten. Abandoned WooCommerce plugins with single-digit version numbers don't get audited, don't get updated, and don't get removed. They persist because WordPress sites accumulate plugins the way sediment accumulates, and no one performs archaeological review when sites change ownership. The severity score stays fixed at 5.3 in 2026, but the actual exposure window for abandoned code is infinite. Sites running this plugin should be treated as having had a PII exposure event regardless of whether exploitation is observed.
One more critical dimension: the primary harm vector may not be fraud at all. A stalker, domestic abuser, or ex-partner often already knows the target's phone number and may have helped set up the loyalty account. For these actors, this isn't a reconnaissance step — it's a direct targeting tool. The 'moderate confidentiality' framing assumes a fraudster threat model that may not even be the primary one.