CVE-2026-111596

MediumCVSS 5.3/10Last modified Oct 21, 2026

Description

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 21, 2026
Last modified: Oct 21, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-11166.1A Cross-site Scripting (XSS) vulnerability was identified in the `from_dict` method of the `AppLollmsMessage` class in parisneo/lollms prior CVE-2026-111606.5Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive infor CVE-2026-1116016.1The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in a CVE-2026-1116023.7The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information CVE-2026-1116034.3PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access depa CVE-2026-1116043.8eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to modify or delete accounts CVE-2026-1116058.1Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated workspace users to access CVE-2026-1116068.1Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons b CVE-2026-1116077.1Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite anothe CVE-2026-1116084.2Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other mer CVE-2026-1116093.8PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription mana CVE-2026-111614.3Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via