CVE-2026-124665: Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Q: Which deployments are exposed to this issue?

WordPress sites using the Order Tracking plugin in versions before 3.6.2 are affected. The vulnerable order-history requests can be made without authentication.

Q: What does an attacker need to exploit it?

An attacker only needs account numbers for customer or sales representative accounts. Because those numbers default to sequential values, they may be enumerated to retrieve order histories for multiple accounts.

Q: What information could be disclosed?

An attacker can retrieve customer and sales representative order histories. In some versions, the disclosed order data also includes order contact email addresses.

Q: How can I determine whether my site may already be vulnerable?

Check whether the installed Order Tracking plugin version is earlier than 3.6.2. Also assess whether customer or sales representative account numbers use the default sequential numbering, which makes enumeration practical.

Published Nov 12, 2026

Updated

The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Order Tracking WordPress plugin to a version that resolves this vulnerability.
Fixed in 3.6.2

Event History

Nov 12, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

WordPress sites using the Order Tracking plugin in versions before 3.6.2 are affected. The vulnerable order-history requests can be made without authentication.

What does an attacker need to exploit it?

An attacker only needs account numbers for customer or sales representative accounts. Because those numbers default to sequential values, they may be enumerated to retrieve order histories for multiple accounts.

What information could be disclosed?

An attacker can retrieve customer and sales representative order histories. In some versions, the disclosed order data also includes order contact email addresses.

How can I determine whether my site may already be vulnerable?

Check whether the installed Order Tracking plugin version is earlier than 3.6.2. Also assess whether customer or sales representative account numbers use the default sequential numbering, which makes enumeration practical.

CVE-2026-124665: Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What information could be disclosed?

How can I determine whether my site may already be vulnerable?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What does an attacker need to exploit it?

What information could be disclosed?

How can I determine whether my site may already be vulnerable?