{"id":"CVE-2026-124665","kind":"vulnerability","aliases":["CVE-2026-124665"],"related":[],"title":"Order Tracking WordPress plugin leaks customer and sales rep order histories","description":"The Order Tracking  WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions.","summary":"The Order Tracking WordPress plugin before 3.6.2 does not check that a visitor owns the customer or sales representative account whose orders they request. Account numbers are sequential, so an unauthenticated visitor can pull the order history of every customer and sales representative, including contact email addresses in some versions.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["order-tracking","package","woocommerce","wordpress"],"not_affected_if":["plugin-3.6.2-or-later"],"how_to_check":"- Check the installed version of the Order Tracking plugin in the WordPress admin under Plugins; a version below `3.6.2` is exposed.","fix":"- Order Tracking WordPress plugin: `3.6.2`","status":"open","published_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","triaged_at":"2026-11-12T06:37:48+00:00","updated_at":"2026-11-12T06:37:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T06:37:48Z","model":"claude-haiku-5-5","output":{"fix":"- Order Tracking WordPress plugin: `3.6.2`","reach":"internet","title":"Order Tracking WordPress plugin leaks customer and sales rep order histories","impact":"medium","summary":"The Order Tracking WordPress plugin before 3.6.2 does not check that a visitor owns the customer or sales representative account whose orders they request. Account numbers are sequential, so an unauthenticated visitor can pull the order history of every customer and sales representative, including contact email addresses in some versions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","order-tracking"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Visitors read other customers' order histories and contact emails","analyst_note":"","how_to_check":"- Check the installed version of the Order Tracking plugin in the WordPress admin under Plugins; a version below `3.6.2` is exposed.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-3.6.2-or-later"],"who_is_affected":"Any WordPress site running the Order Tracking plugin before 3.6.2 exposes customer and sales representative order data to anyone who can reach the order lookup. Sites that do not run this plugin, or that have upgraded to 3.6.2 or later, are not affected. The sources do not say whether the lookup requires any particular plugin setting.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4552,"output_tokens":553,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-124665':14A,17A '-2026':13A,16A '3.6.2':30B,80C 'account':43B,48B,93C,100C 'address':70B,124C 'allow':106C 'check':33B 'contact':68B,122C 'custom':6A,39B,63B,89C,116C 'cve':12A,15A 'default':102C 'email':69B,123C 'everi':62B,115C 'histori':11A,60B,113C 'includ':67B,120C 'leak':5A 'number':49B,101C 'order':1A,10A,19B,25B,45B,59B,75C,95C,112C,121C 'order-track':18B 'own':37B,87C 'packag':21B 'plugin':4A,28B,78C 'pull':57B 'rep':9A 'repres':42B,66B,92C,119C 'request':47B,97C 'retriev':110C 'sale':8A,41B,65B,91C,118C 'sequenti':51B,104C 'track':2A,20B,26B,76C 'unauthent':54B,107C 'user':108C 'valu':105C 'verifi':83C 'version':73B,127C 'visitor':36B,55B,86C 'whose':44B,94C 'woocommerc':22B 'wordpress':3A,23B,27B,77C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Order Tracking plugin before 3.6.2 exposes customer and sales representative order data to anyone who can reach the order lookup. Sites that do not run this plugin, or that have upgraded to 3.6.2 or later, are not affected. The sources do not say whether the lookup requires any particular plugin setting.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","ordertracking","package","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-124665':14A,17A '-2026':13A,16A 'custom':6A 'cve':12A,15A 'histori':11A 'leak':5A 'order':1A,10A 'plugin':4A 'rep':9A 'sale':8A 'track':2A 'wordpress':3A","search_b":"'3.6.2':30B 'account':43B,48B 'address':70B 'check':33B 'contact':68B 'custom':39B,63B 'email':69B 'everi':62B 'histori':60B 'includ':67B 'number':49B 'order':19B,25B,45B,59B 'order-track':18B 'own':37B 'packag':21B 'plugin':28B 'pull':57B 'repres':42B,66B 'request':47B 'sale':41B,65B 'sequenti':51B 'track':20B,26B 'unauthent':54B 'version':73B 'visitor':36B,55B 'whose':44B 'woocommerc':22B 'wordpress':23B,27B","search_c":"'3.6.2':80C 'account':93C,100C 'address':124C 'allow':106C 'contact':122C 'custom':89C,116C 'default':102C 'email':123C 'everi':115C 'histori':113C 'includ':120C 'number':101C 'order':75C,95C,112C,121C 'own':87C 'plugin':78C 'repres':92C,119C 'request':97C 'retriev':110C 'sale':91C,118C 'sequenti':104C 'track':76C 'unauthent':107C 'user':108C 'valu':105C 'verifi':83C 'version':127C 'visitor':86C 'whose':94C 'wordpress':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:13+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124665","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124665","severity":null,"published_at":"2026-11-12T06:17:13+00:00","modified_at":"2026-11-12T06:17:13+00:00","first_seen_at":"2026-11-12T06:36:54+00:00","fetched_at":"2026-11-12T06:36:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}