Wordpress Alert: Order record access bypass

What it looks like

A customer can view or alter an order that is not theirs.

Why it matters

Names, addresses, and purchase details may leak.

What to check

Check order ownership in custom endpoints and extensions.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WooCommerce orders API, WordPress roles and capabilities.