CVE-2026-111596 — Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

CVE-2026-111596

Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR PUBLISHED

Description (CNA)

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

Affected (CNA)

Vendor / product	Versions
Unknown / Kliken: Ads + Pixel for Meta	affected 0 before 1.2.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8bba9959-9c7a-4564-bcba-fc34a922ecc7/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.