CVE-2026-111596CWE-639

CVE-2026-111596

Medium · published October 21, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
9.6
In the wild
Unconfirmed
What it is

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00202 · 9.6th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-10-21T10:16Z
References (1)
https://wpscan.com/vulnerability/8bba9959-9c7a-4564-bcba-fc34a922ecc7/ · [email protected]
EPSS history
Timeline
  • 22 OCT 03:29Z
    EPSS moved — → 0%
    epss
  • 21 OCT 06:00Z
    Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR
    cvelistv5
  • 21 OCT 06:00Z
    Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR
    cvelistv5