This is an IDOR in the MStore API plugin's vendor-orders endpoint, present in versions before 4.21.0. The vulnerability allows any authenticated user — including Subscriber-level accounts — to retrieve orders from any vendor in a multi-vendor WooCommerce store. This isn't a theoretical access control gap; it's complete customer database enumeration: names, addresses, emails, and order details for every order in the system, accessible by anyone with a valid store account.
What makes this severe in practice is the enumeration dimension. CVSS 6.5 treats this as a single-request vulnerability, but the real exposure is that an attacker with valid credentials can iterate order IDs and exfiltrate the entire store's transaction history. That's not medium-severity — that's systemic data exposure. Additionally, in a multi-vendor marketplace context, this vulnerability lets each vendor see competitor transaction data: volumes, pricing patterns, customer relationships. That's competitive intelligence harvesting, not just privacy leakage.
The fix in 4.21.0 presumably adds permission checks, but verify two layers. First, confirm the endpoint now validates that the requesting user has legitimate access to the specific order being requested. Second, confirm it validates the vendor context — that the user is authorized to see orders for that specific vendor, not just any order belonging to any vendor. A permissions callback that only checks current_user_can('edit_shop_orders') handles the user-scoping layer but may miss the vendor-context binding. Without both, the enumeration path remains open even with the patch.
Also verify rate limiting exists on this endpoint. Proper authorization without rate limiting still allows bulk exfiltration through ID iteration. If rate limiting is absent, that's a hardening gap that compounds the authorization fix.
Finally, note the client-side remediation window. MStore powers mobile shopping apps. The server-side patch fixes the API, but every mobile app binary already distributed remains a vulnerable client that can hit the endpoint — or the next misconfigured one. Pushing app store updates takes weeks or months. The exposure window isn't just between disclosure and server-side patching; it's multiplied by client-side distribution lag.