This CVE exposes a WooCommerce plugin that failed to verify order ownership before returning order contents or restoring order contents to the user's cart. The vulnerability was accessible without authentication — anyone with a valid order ID could retrieve that order's data or manipulate the cart using it.
The root cause is straightforward: the plugin accepted an order ID from user input ($_GET['order_id']), sanitized it, but never verified that the requesting user owned that order. WooCommerce order IDs are sequential integers visible in confirmation emails, invoices, and the refund workflow — they're not secrets. An attacker can enumerate them trivially by collecting any customer's order confirmation email or observing the sequential IDs in publicly-shared invoice patterns.
The fix requires a single ownership check: verify that get_current_user_id() matches $order->get_user_id() (or use current_user_can('edit_shop_order', $order_id) for admin-level operations). This is not a case where secure implementation required architectural work — it's a one-line authorization gate that was simply missing.
For defenders auditing WooCommerce plugins: any plugin that accepts an order ID from user input and returns order data or performs cart operations is suspect until proven otherwise. The vulnerability class is authentication-checked-but-not-authorization-scoped — the plugin verified the user was logged in but never verified the user owned the specific order. Review any plugin feature that takes an order_id parameter and returns order contents, prices, addresses, or modifies cart state. The absence of a get_current_user_id() === $order->get_user_id() check (or its capability-based equivalent) is the vulnerability signature.
This pattern likely exists in other WooCommerce plugins. The platform provides wc_get_order() but does not model ownership-scoped access as the required default pattern in its documentation or codebase — developers must independently recognize that every order-related operation requires explicit ownership verification. Treat this CVE as a beacon: if you're running plugins that handle order data and accept order IDs as parameters, audit them for this specific authorization gap.