Security Alert Summary
The Klarna for WooCommerce plugin contains an authorization bypass that allows access to sensitive order details. Due to missing authorization checks, an unauthenticated actor can retrieve an order’s secret order_key and full billing and shipping PII exposed in JavaScript on the order-pay page, enabling store-wide order enumeration.
CVE Details
- CVE ID: CVE-2026-110590
- Affected component: Klarna for WooCommerce plugin
- Affected versions: All versions up to and including 4.13.3
- Published: October 16, 2026 at 5:17:29 AM
- Last modified: October 16, 2026 at 3:17:11 PM
- CVSS v3.1 base score: 7.5 (HIGH)
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Authentication requirements: None required
- Privileges required: None
- User interaction: None
- Primary impact: Confidentiality: High; Integrity: None; Availability: None
- Weakness: CWE-862 (Missing Authorization)
Technical Details
The plugin fails to verify that a requesting user is authorized to perform actions that expose order details. The vulnerable behavior results in the plugin emitting a JavaScript variable named klarna_payments_params inline on the order-pay page containing an orders secret order_key and full billing and shipping PII, including first name, last name, email address, phone number, street address, postcode, city, region, and country. Because WooCommerce order IDs are sequential integers and the endpoint does not require an order_key or an authenticated session, an unauthenticated actor can make sequential GET requests to the order-pay endpoint to enumerate orders and retrieve that exposed data.
How This Could Impact Your Website
In a small business WordPress site where multiple people interact with WooCommerce, this vulnerability can affect site owners, internal staff, and external contractors. For example, an unauthenticated actor could enumerate order IDs and collect customer billing and shipping details that are exposed on the order-pay page. That could reveal internal or customer email addresses and phone numbers, increasing the risk of targeted phishing or social engineering against staff or customers. The exposure is limited to the data emitted by the plugin on the order-pay page and does not, based on the provided information, indicate direct modification of orders. professional review can help you determine whether your site is affected and how to assess current user roles and plugins.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level or other low-privilege roles that are not needed.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce attack surface.
- Monitor site activity and access logs for unusual behavior, including repeated requests to order-pay endpoints or large sequences of order ID requests.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/krokedil/klarna-payments-for-woocommerce/compare/4.13.3…f5362605a9901b7f9264cfa3b22fd782a7a3097b
- https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L159
- https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L185
- https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L198
- https://plugins.trac.wordpress.org/browser/klarna-payments-for-woocommerce/tags/4.13.3/classes/class-kp-assets.php#L204
- https://plugins.trac.wordpress.org/changeset/3740915/klarna-payments-for-woocommerce/trunk/classes/class-kp-assets.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/c3abb96e-6ee2-4992-a122-9f661da9a4d6?source=cve
