CVE-2026-124665: medium-severity vulnerability in Order Tracking
Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 5.3epss 0.1%
The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Unknown · Order Trackingpublic PoCs found — 1
cve_referencewpscan.com/vulnerability/9165da1e-76b7-4364-9fd7-67ccb96afc48/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Order Tracking
In the same product, most dangerous first.