CVE-2026-111596mediumCWE-639

CVE-2026-111596: medium-severity vulnerability in Kliken: Ads + Pixel for Meta

Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

Published

Follow this CVE+ Monitor Kliken: Ads + Pixel for Meta

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.3%
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Kliken: Ads + Pixel for Meta
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.