CVE-2020-29156

The WooCommerce plugin before 4.7.0 for WordPress allows remote attackers to view the status of arbitrary orders via the orderid parameter in a fetchorderstatus action...

CVE-2020-29156

The CVE concerns the WooCommerce plugin for WordPress, affecting versions prior to 4.7.0. A defect in the fetch_order_status action permits remote attackers to disclose the status of arbitrary orders by supplying an order_id. The root cause is improper authorization/validation in the order status...