CVE-2026-111596

The Kliken: Ads + Pixel for Meta WordPress plugin, in versions before 1.2.3 , is vulnerable to an unauthenticated order data disclosure due to an Insecure Direct Object Reference (IDOR) . The application fails to verify that a visitor possesses a specific order's key before displaying order detai...

CVE-2026-111596 Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other...

CVE-2026-111596 Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR

The Kliken: Ads + Pixel for Meta WordPress plugin before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page, allowing unauthenticated users to retrieve the billing location, purchased products and totals of other...

WordPress Kliken: Ads + Pixel for Meta plugin < 1.2.3 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Huseyn in WordPress Plugin Kliken: Ads + Pixel for Meta versions 1.2.3...

WordPress Visma Pay for WooCommerce plugin < 1.2.2 - Unauthenticated Payment Bypass and Order Data Disclosure vulnerability

Unauthenticated Payment Bypass and Order Data Disclosure vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Visma Pay for WooCommerce versions 1.2.2...

WordPress NP Quote Request for WooCommerce plugin 2.0-2.4.15 - Unauthenticated Order Data Disclosure vulnerability

Unauthenticated Order Data Disclosure vulnerability discovered by Murad Islamzada in WordPress Plugin NP Quote Request for WooCommerce versions 2.0-2.4.15...

CVE-2026-93528 NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

CVE-2026-93528

The NP Quote Request for WooCommerce WordPress plugin (versions 2.0-2.4.15 ) is vulnerable to unauthenticated order data disclosure . The root cause is located in the gpls_woo_rfq_get_rfq_cart() function within includes/classes/gpls_woo_rfq_functions.php, which fails to validate order ownership w...

CVE-2026-93528 NP Quote Request for WooCommerce < 2.4.16 - Unauthenticated Order Data Disclosure via Quote Request Page

The NP Quote Request for WooCommerce WordPress plugin before 2.4.16 does not verify order ownership before rendering an order's details, allowing unauthenticated attackers to view another customer's order using the order's key...

WordPress WP Crowdfunding plugin < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR vulnerability

Subscriber+ Order Data Disclosure via IDOR vulnerability discovered by Sajjad Haqi in WordPress Plugin WP Crowdfunding versions 2.2.1...

WordPress WP Helper Premium plugin < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability

Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation vulnerability discovered by Farid Narimanov in WordPress Plugin WP Helper Premium versions 4.7.6...

CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-18945

The WP Helper Premium WordPress plugin (versions before 4.7.6 ) is vulnerable to an authorization bypass due to a missing order key validation . The flaw occurs when the plugin renders its custom order confirmation page or handles related AJAX actions. This allows unauthenticated users to view se...

CVE-2026-18945 WP Helper Premium < 4.7.6 - Unauthenticated Order Data Disclosure and Order Manipulation via Missing Order Key Validation

The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change t...

CVE-2026-14858 WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14858 WP Crowdfunding < 2.2.1 - Subscriber+ Order Data Disclosure via IDOR

The WP Crowdfunding WordPress plugin before 2.2.1 does not verify order ownership before returning order details, allowing any authenticated users such as Subscribers to read the personal data of any WooCommerce order and enumerate every order in the store...

CVE-2026-14858

The WP Crowdfunding WordPress plugin (versions before 2.2.1 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The root cause is a failure to verify order ownership before returning order details. This allows any authenticated user, such as a Subscriber , to access the personal d...

CVE-2026-18357 WPC Order Tip for WooCommerce < 3.3.1 - Unauthenticated Order Data Disclosure

The WPC Order Tip for WooCommerce WordPress plugin before 3.3.1 does not perform authorisation or nonce checks in one of its reporting features, allowing unauthenticated attackers to retrieve sensitive order data belonging to any customer of the store, such as billing names, order IDs and statuse...

CVE-2026-65760

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...

CVE-2026-65760 Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1

Joomla Extension - joomshaper.com - cross-customer order and personal information disclosure in Easy Store extension 1.0.0-2.0.1 - Improper access checks allow logged in users to retreive order and customer information of any order in the system...