# Klarna Payments for WooCommerce <= 4.13.3 - Unauthenticated Insecure Direct Object Reference to Order Key and Customer Address Exposure via Order-Pay Page

- **ID:** WPSEC-2026-0829
- **Plugin:** Klarna for WooCommerce (`klarna-payments-for-woocommerce`), https://wordpress.org/plugins/klarna-payments-for-woocommerce/
- **Affected versions:** all versions before 4.13.4
- **Fixed in:** 4.13.4 (Update to 4.13.4 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/klarna-payments-for-woocommerce
- **Fix released:** 2026-10-12
- **Published:** 2026-10-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0829/

## Description

The Klarna for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference via the order-pay endpoint in all versions up to, and including, 4.13.3. This is due to the checkout script parameters loading any order by the ID in the order-pay URL without checking the request's order key or whether the visitor is allowed to pay for the order. This makes it possible for unauthenticated attackers to enumerate order IDs and retrieve other customers' order keys, along with their names, email addresses, phone numbers and billing and shipping addresses.

## References

- https://wpsec.com/vuln/WPSEC-2026-0829/
- https://plugins.svn.wordpress.org/klarna-payments-for-woocommerce/tags/4.13.4/
- https://wordpress.org/plugins/klarna-payments-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0829/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.