[ CVE-2026-111596 · Published 21 Oct 2026 ]
Vulnerability in Unknown Kliken: Ads + Pixel for Meta
CVSS 5.3
EPSS <1%No fix listed yet
[ Description ]Official description
The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.