---
id: "CVE-2026-111596"
kind: "vulnerability"
aliases: ["CVE-2026-111596"]
title: "Kliken Ads WordPress plugin leaks other customers' order details"
severity: "medium"
cvss: 5.3
epss: 0.00202
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ecommerce", "kliken", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-version-1.2.3-or-later"]
published_at: "2026-10-21T06:16:48+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T04:21:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111596", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-111596", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Kliken Ads WordPress plugin leaks other customers' order details

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 shows an order's confirmation page without checking that the visitor holds that order's key. An unauthenticated attacker can enumerate order IDs to read other customers' billing location, purchased products and totals.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Kliken: Ads + Pixel for Meta plugin in the WordPress admin plugins list, or with `wp plugin get kliken-ads-pixel-for-meta --field=version` if the slug is unknown, and see whether it is below `1.2.3`.
- Confirm that WooCommerce order confirmation pages are reachable by changing an order ID in the URL while logged out.

## Fix

- Update the Kliken: Ads + Pixel for Meta plugin to `1.2.3` or later.
- Until updated, deactivate the plugin if order confirmation data is not needed by it.

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111596
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-111596

## From the sources

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_