Vulnerabilities / Klarna Payments for WooCommerce / WPSEC-2026-0829
Klarna Payments for WooCommerce <= 4.13.3 - Unauthenticated Insecure Direct Object Reference to Order Key and Customer Address Exposure via Order-Pay Page
Medium 5.3
CWE-639Fixed in 4.13.4
- ID
- WPSEC-2026-0829
- Plugin
- Klarna for WooCommerce (klarna-payments-for-woocommerce)
- Affected
- all versions before 4.13.4
- Remediation
- Update to 4.13.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-13
- Attack surface
- Klarna Payments for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Klarna for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the order-pay endpoint in all versions up to, and including, 4.13.3. This is due to the checkout script parameters loading any order by the ID in the order-pay URL without checking the request's order key or whether the visitor is allowed to pay for the order. This makes it possible for unauthenticated attackers to enumerate order IDs and retrieve other customers' order keys, along with their names, email addresses, phone numbers and billing and shipping addresses.
References
- https://wpsec.com/vuln/WPSEC-2026-0829/
- https://plugins.svn.wordpress.org/klarna-payments-for-woocommerce/tags/4.13.4/
- https://wordpress.org/plugins/klarna-payments-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS