Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise using Payment EX.
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor