CVE-2026-110590
Received Received - Intake

Authorization Bypass in Klarna for WooCommerce Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110590
EUVD
EUVD-2026-102650

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
klarnaplugin Klarna for WooCommerce 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Klarna for WooCommerce plugin for WordPress has an authorization bypass vulnerability in versions up to 4.13.3. The plugin fails to verify user authorization before exposing sensitive order data. Unauthenticated attackers can access any order's secret order_key and full billing and shipping personally identifiable information (PII) via the klarna_payments_params JavaScript variable. This occurs because WooCommerce order IDs are sequential, allowing trivial enumeration of all orders through sequential GET requests to the order-pay endpoint.

Detection Guidance

Check for unauthorized access to order-pay endpoints by monitoring GET requests to /order-pay/?key= with sequential order IDs. Inspect klarna_payments_params JavaScript variables for exposed PII in order-pay pages. Review server logs for unusual requests to order endpoints.

Impact Analysis

This vulnerability allows attackers to access sensitive customer data, including names, email addresses, phone numbers, and physical addresses. Since order IDs are sequential, attackers can systematically retrieve all orders in a store. This exposes customers to identity theft, phishing attacks, or fraud. Store owners may face reputational damage, loss of customer trust, and potential legal consequences due to data breaches.

Compliance Impact

This vulnerability likely violates GDPR due to unauthorized access to personal data and insufficient protection measures. It may also breach HIPAA if customer health-related data is exposed. Organizations could face fines, legal actions, and mandatory breach notifications. Compliance with data protection regulations requires ensuring unauthorized access is prevented, which this vulnerability fails to do.

Mitigation Strategies

Update the Klarna for WooCommerce plugin to the latest version (4.13.4 or higher). Implement strict access controls for order-pay endpoints. Disable unnecessary order data exposure in JavaScript variables. Monitor for unauthorized enumeration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110590. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart