CVE-2026-110590

CVE-2026-110590 · Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key and full billing and shipping PII — including first name, last name, email address, phone number, street address, postcode, city, region, and country — emitted inline as the klarna_payments_params JavaScript variable, enabling full store-wide order enumeration. Because WooCommerce order IDs are sequential integers and no order_key or authenticated session is required, every order in the store can be trivially enumerated with sequential GET requests to the order-pay endpoint.

CVSS 7.5 · Élevée · EPSS 0,3%

Publication

2026-10-16T04:27:03.790Z

Mise à jour

2026-10-16T15:09:39.428Z

Vérifiez votre serveur →