Paid Membership Pro < 2.5.3 - Unauthorised Order Information Disclosure

Description

The pmpro_get_order_json AJAX action, available to authenticated user did not check for authorisation, allowing any authenticated users to retrieve arbitrary order information (such as customer names, email addresses, and order numbers) via the order_id parameter.