CVE-2026-111596
Deferred Deferred - Pending Action

Kliken Plugin Unauthenticated Order Data Exposure

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: WPScan

Description
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-09
NVD
CVE-2026-111596
EUVD
EUVD-2026-107073

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Kliken: Ads + Pixel for Meta 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the Kliken: Ads + Pixel for Meta WordPress plugin before version 1.2.3. It allows unauthenticated users to access sensitive order details of other customers by exploiting the lack of verification for order keys on the order confirmation page. Attackers can retrieve billing locations, purchased products, and order totals by enumerating order IDs.

Detection Guidance

To detect this vulnerability, check if the WordPress plugin 'Kliken: Ads + Pixel for Meta' is running a version prior to 1.2.3. You can use commands like 'wp plugin list' in WordPress CLI or inspect the plugin version via the WordPress admin panel. Additionally, monitor network traffic for unauthenticated requests to order confirmation endpoints that expose sensitive data.

Impact Analysis

This vulnerability can lead to unauthorized access to other customers' order information, including billing locations, purchased products, and order totals. This may result in privacy breaches, financial data exposure, and potential misuse of customer data.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to personal and financial data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach could result in legal penalties and reputational damage.

Mitigation Strategies

Immediately update the 'Kliken: Ads + Pixel for Meta' plugin to version 1.2.3 or later. If updating is not possible, consider disabling the plugin temporarily until an update is applied. Review server logs for suspicious activity related to order ID enumeration.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111596. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...