CVE-2026-111596: Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

Q: Who can exploit this issue?

Any unauthenticated visitor can exploit it. An attacker can enumerate order IDs to retrieve other customers' billing location, purchased products, and order totals.

Q: What versions are affected?

Versions of Kliken: Ads + Pixel for Meta before 1.2.3 are affected.

Q: What should be prioritized for remediation?

Update the plugin to version 1.2.3 or later. The affected behavior exposes order information without requiring authentication or possession of the order key.

Published Oct 21, 2026

Updated

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.

Affected Software

1 affected component

Kliken Ads + Pixel for Meta<1.2.3

Event History

Oct 21, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated visitor can exploit it. An attacker can enumerate order IDs to retrieve other customers' billing location, purchased products, and order totals.

What versions are affected?

Versions of Kliken: Ads + Pixel for Meta before 1.2.3 are affected.

What should be prioritized for remediation?

Update the plugin to version 1.2.3 or later. The affected behavior exposes order information without requiring authentication or possession of the order key.

CVE-2026-111596: Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

What should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What versions are affected?

What should be prioritized for remediation?