{
 "id": "WPSEC-2026-1710",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1710/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1710/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1710/index.md",
 "title": "Klarna for WooCommerce <= 4.13.4 - Unauthenticated Server-Side Request Forgery via Authorization Token",
 "description": "The Klarna for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery via the Klarna authorization token in all versions up to, and including, 4.13.4. This is due to the token submitted by the customer's browser during checkout being placed into the Klarna API request path without URL encoding when placing orders and creating customer tokens. This makes it possible for unauthenticated attackers to use path characters such as '../', '?' or '#' to make the server send requests, authenticated with the merchant's Klarna API credentials, to other endpoints on the Klarna API.",
 "plugin": {
  "slug": "klarna-payments-for-woocommerce",
  "name": "Klarna for WooCommerce",
  "full_name": "Klarna for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/klarna-payments-for-woocommerce/",
  "advisories_url": "https://wpsec.com/vuln/plugin/klarna-payments-for-woocommerce/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/klarna-payments-for-woocommerce"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.13.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.13.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.13.5",
 "remediation": "Update to 4.13.5 or later.",
 "fix_released": "2026-10-26T10:03:22+00:00",
 "published": "2026-10-27T10:49:10+00:00",
 "updated": "2026-10-26T13:02:05.035729+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1710/",
  "https://plugins.svn.wordpress.org/klarna-payments-for-woocommerce/tags/4.13.5/",
  "https://wordpress.org/plugins/klarna-payments-for-woocommerce/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/klarna-payments-for-woocommerce",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-27"
 }
}