{"id":"CVE-2026-111596","kind":"vulnerability","aliases":["CVE-2026-111596"],"related":[],"title":"Kliken Ads WordPress plugin leaks other customers' order details","description":"The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.","summary":"The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 shows an order's confirmation page without checking that the visitor holds that order's key. An unauthenticated attacker can enumerate order IDs to read other customers' billing location, purchased products and totals.","severity":"medium","cvss":5.3,"epss":0.00202,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","kliken","package","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-1.2.3-or-later"],"how_to_check":"- Check the installed version of the Kliken: Ads + Pixel for Meta plugin in the WordPress admin plugins list, or with `wp plugin get kliken-ads-pixel-for-meta --field=version` if the slug is unknown, and see whether it is below `1.2.3`.\n- Confirm that WooCommerce order confirmation pages are reachable by changing an order ID in the URL while logged out.","fix":"- Update the Kliken: Ads + Pixel for Meta plugin to `1.2.3` or later.\n- Until updated, deactivate the plugin if order confirmation data is not needed by it.","status":"open","published_at":"2026-10-21T06:16:48+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:21:10+00:00","updated_at":"2026-10-25T04:21:10+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:21:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Kliken: Ads + Pixel for Meta plugin to `1.2.3` or later.\n- Until updated, deactivate the plugin if order confirmation data is not needed by it.","reach":"internet","title":"Kliken Ads WordPress plugin leaks other customers' order details","impact":"medium","summary":"The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 shows an order's confirmation page without checking that the visitor holds that order's key. An unauthenticated attacker can enumerate order IDs to read other customers' billing location, purchased products and totals.","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","ecommerce","kliken"],"confidence":0.7,"needs_auth":"no","worst_case":"Other customers' billing location, purchases and totals readable by enumeration","analyst_note":"","how_to_check":"- Check the installed version of the Kliken: Ads + Pixel for Meta plugin in the WordPress admin plugins list, or with `wp plugin get kliken-ads-pixel-for-meta --field=version` if the slug is unknown, and see whether it is below `1.2.3`.\n- Confirm that WooCommerce order confirmation pages are reachable by changing an order ID in the URL while logged out.","needs_analyst":false,"not_affected_if":["plugin-version-1.2.3-or-later","plugin-not-installed"],"who_is_affected":"Stores running the Kliken: Ads + Pixel for Meta WordPress plugin before `1.2.3` with order confirmation pages enabled are exposed, because the page shows order data to anyone who has an order ID. Sites without this plugin, or running `1.2.3` or later, are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000659,"input_tokens":3378,"output_tokens":642,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-111596':12A,15A '-2026':11A,14A '1.2.3':30B,73C 'ad':2A,23B,66C 'allow':96C 'attack':49B 'bill':58B,102C 'check':38B 'confirm':35B,94C 'custom':7A,57B,110C 'cve':10A,13A 'detail':9A,90C 'ecommerc':16B 'enumer':51B,113C 'hold':42B,80C 'id':53B,115C 'key':46B,84C 'kliken':1A,17B,22B,65C 'leak':5A 'locat':59B,103C 'meta':26B,69C 'order':8A,33B,44B,52B,82C,88C,93C,111C,114C 'output':86C 'packag':18B 'page':36B,95C 'pixel':24B,67C 'plugin':4A,28B,71C 'product':61B,105C 'purchas':60B,104C 'read':55B 'retriev':100C 'show':31B 'total':63B,107C 'unauthent':48B,97C 'user':98C 'verifi':76C 'visitor':41B,79C 'without':37B 'woocommerc':19B 'wordpress':3A,20B,27B,70C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Kliken: Ads + Pixel for Meta WordPress plugin before `1.2.3` with order confirmation pages enabled are exposed, because the page shows order data to anyone who has an order ID. Sites without this plugin, or running `1.2.3` or later, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:48+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111596","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111596","severity":null,"published_at":"2026-10-21T06:16:48+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111596","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111596","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}