Live › vulnerability › CVE-2026-111596
Go to dashboardThe Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 shows an order's confirmation page without checking that the visitor holds that order's key. An unauthenticated attacker can enumerate order IDs to read other customers' billing location, purchased products and totals.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Stores running the Kliken: Ads + Pixel for Meta WordPress plugin before with order confirmation pages enabled are exposed, because the page shows order data to anyone who has an order ID. Sites without this plugin, or running or later, are not affected.
1.2.31.2.3No product ranges from the sources yet.
wp plugin get kliken-ads-pixel-for-meta --field=version if the slug is unknown, and see whether it is below 1.2.3.1.2.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.
This page as .md · .json · in your agent: get_signal("CVE-2026-111596")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.