We bought the Charge Plugin and got it up and running for a subscription service and the website has just gone live. We just realised any new user (subscriber) has access to all other users details if they know the control panel URL!!
Charge is the only plugin ignoring user permissions in the CP. With all permissions turned off, Charge is still available in the left hand panel.
Please advise A.S.A.P.