WordPress Plugin Vulnerabilities

Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

Description

The plugin does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

Proof of Concept

Affects Plugins

Plugin icon
kliken-ads-pixel-for-meta
Fixed in 1.2.3

References

CVE
CVE-2026-111596

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Huseyn
Submitter
Huseyn
Verified
Yes
WPVDB ID
8bba9959-9c7a-4564-bcba-fc34a922ecc7

Timeline

Publicly Published
2026-10-19 (about 2 days ago)
Added
2026-10-19 (about 1 day ago)
Last Updated
2026-10-19 (about 1 day ago)

Other

Published
Title
Published
2025-10-10
Title
WPC Smart Wishlist for WooCommerce < 5.0.4 - Insecure Direct Object Reference to Unauthenticated Wishlist Manipulation
Published
2025-07-16
Title
Maya Business < 1.3.0 - Unauthenticated Insecure Direct Object Reference
Published
2026-01-01
Title
Cocco <= 1.5.1 - Authenticated (Subscriber+) Authenticated Insecure Direct Object Reference
Published
2026-08-15
Title
Online Scheduling and Appointment Booking System – Bookly < 28.0 - Authenticated (Staff+) Insecure Direct Object Reference to Sensitive Information Exposure via 'params[id]' Parameter
Published
2025-04-30
Title
WordPress Simple PayPal Shopping Cart < 5.1.4 - Insecure Direct Object Reference via 'quantity'