WS-2021-0130

Klaviyo Magento 2 before 3.0.0 allows reading private customer data from stores. It works by reclaiming any guest-cart as your own and reading the private data for the orders in the Magento API...