CVE-2026-18357 is a critical IDOR vulnerability in a WooCommerce-compatible WordPress plugin reporting endpoint. Unlike a simple auth bypass, this vulnerability allows any unauthenticated attacker to enumerate and retrieve specific order or customer data by manipulating order IDs in the request — the endpoint likely accepts valid sessions but fails to verify the authenticated user actually owns or has privileges over the requested resource. The complete absence of both authorization and nonce checks indicates this endpoint was added as a convenience feature during development, likely with the implicit assumption that only legitimate store operators would use it.
What makes this particularly dangerous is the blast radius: because this exact vulnerability class (unauthenticated IDOR exposing WooCommerce order data) recurs with documented regularity across the plugin ecosystem, attackers have built reusable enumeration tooling. One successful scan yields data from every vulnerable store running the plugin. The CVSS 7.5 score measures single-installation impact but systematically underestimates the ecosystem-level risk. The data exposed — customer names, order amounts, dates, addresses, order statuses — provides exactly the correlation points needed for social engineering or business email compromise operations.
Check whether your WooCommerce installation has any reporting, export, or download endpoints that don't require explicit object-level ownership verification. If the plugin offers a reporting feature, verify that accessing another order's report returns a 403 — if it returns 200 with data, you're vulnerable. The fix in version 3.3.1 should include a current_user_can() check combined with an object ownership verification (e.g., checking that the current user is the order owner or an admin). If you're on an earlier version, update immediately. If the plugin is no longer maintained, consider removing it — the WooCommerce extensions market creates structural incentives for plugins to accumulate vulnerabilities over time as developers adapt endpoints for REST API, AJAX, or webhook integrations, often stripping auth checks in the process.