Klarna for WooCommerce <= 4.13.4 - Unauthenticated Business Logic Flaw via Express Checkout Paid Order Reuse
- ID
- WPSEC-2026-1711
- Plugin
- Klarna for WooCommerce (klarna-payments-for-woocommerce)
- Affected
- all versions before 4.13.5
- Remediation
- Update to 4.13.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-841
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Klarna for WooCommerce on WPSec AttackSurface
- Fix released
- Published
Description
The Klarna for WooCommerce plugin for WordPress is vulnerable to a business logic flaw via the one-step Express Checkout in all versions up to, and including, 4.13.4. This is due to the plugin reusing the order ID stored in the customer's session without checking that the order still needs payment, so the shipping address and shipping option AJAX handlers rebuild an order that has already been paid. This makes it possible for unauthenticated attackers, such as guest customers, to replace the items, shipping and totals of their own already-paid order with the contents of a new cart, which can leave the store holding a paid order for goods that were never paid for. Exploitation requires the one-step Klarna Express Checkout flow to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1711/
- https://plugins.svn.wordpress.org/klarna-payments-for-woocommerce/tags/4.13.5/
- https://wordpress.org/plugins/klarna-payments-for-woocommerce/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS