---
id: "CVE-2026-124665"
page: "https://infrastack.ai/live/CVE-2026-124665"
kind: "vulnerability"
aliases: ["CVE-2026-124665"]
title: "Order Tracking WordPress plugin leaks customer and sales rep order histories"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["order-tracking", "package", "woocommerce", "wordpress"]
not_affected_if: ["plugin-3.6.2-or-later"]
published_at: "2026-11-12T06:17:13+00:00"
first_seen_at: "2026-11-12T06:36:54+00:00"
updated_at: "2026-11-12T06:37:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124665", "first_seen_at": "2026-11-12T06:36:54+00:00"}]
exploit_sources: []
---

# Order Tracking WordPress plugin leaks customer and sales rep order histories

Link for people: https://infrastack.ai/live/CVE-2026-124665 (this .md is for agents)

The Order Tracking WordPress plugin before 3.6.2 does not check that a visitor owns the customer or sales representative account whose orders they request. Account numbers are sequential, so an unauthenticated visitor can pull the order history of every customer and sales representative, including contact email addresses in some versions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of the Order Tracking plugin in the WordPress admin under Plugins; a version below `3.6.2` is exposed.

## Fix

- Order Tracking WordPress plugin: `3.6.2`

## Timeline

- 2026-11-12T06:36:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124665

## From the sources

The Order Tracking  WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_