CVE-2026-111596 — MEDIUM (5.3)

Vulnerability Description

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

CVSS Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Related Weaknesses (CWE)

CWE-639

References

https://wpscan.com/vulnerability/8bba9959-9c7a-4564-bcba-fc34a922ecc7/

FAQ

What is CVE-2026-111596?

CVE-2026-111596 is a vulnerability with a CVSS score of 5.3 (MEDIUM). The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unaut...

How severe is CVE-2026-111596?

CVE-2026-111596 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-111596?

Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.