Live › vulnerability › CVE-2026-110590
Go to dashboardThe Klarna for WooCommerce WordPress plugin, up to and including 4.13.3, fails to check authorization on the order-pay page. An unauthenticated attacker can read any order's secret order_key and full billing and shipping personal data, including names, emails, phone numbers and addresses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores running WordPress with WooCommerce and the Klarna for WooCommerce plugin at version 4.13.3 or earlier are exposed, because the order-pay endpoint is reachable without login and order IDs are sequential. Stores that do not use this plugin, or that run a fixed later version, can skip it.
No product ranges from the sources yet.
4.13.3 or earlier is affected4.13.3, as published by the vendorEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.
This page as .md · .json · in your agent: get_signal("CVE-2026-110590")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.