PT-2026-120468
CVE-2026-111596
·
Published
2026-10-21
·
Updated
2026-10-21
Description by
CVSS 3.1
5.3
MediumMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Kliken: Ads + Pixel for Meta versions prior to 1.2.3
Description
An Insecure Direct Object Reference (IDOR) exists on the order confirmation page. The plugin fails to verify if a visitor possesses the required order key before displaying order details. This allows unauthenticated users to retrieve the billing location, purchased products, and order totals of other customers by enumerating order IDs.
Recommendations
Update to version 1.2.3 or later.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾