# Klarna for WooCommerce <= 4.13.4 - Unauthenticated Business Logic Flaw via Express Checkout Paid Order Reuse

- **ID:** WPSEC-2026-1711
- **Plugin:** Klarna for WooCommerce (`klarna-payments-for-woocommerce`), https://wordpress.org/plugins/klarna-payments-for-woocommerce/
- **Affected versions:** all versions before 4.13.5
- **Fixed in:** 4.13.5 (Update to 4.13.5 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-841
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-27)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/klarna-payments-for-woocommerce
- **Fix released:** 2026-10-26
- **Published:** 2026-10-27
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1711/

## Description

The Klarna for WooCommerce plugin for WordPress is vulnerable to a business logic flaw via the one-step Express Checkout in all versions up to, and including, 4.13.4. This is due to the plugin reusing the order ID stored in the customer's session without checking that the order still needs payment, so the shipping address and shipping option AJAX handlers rebuild an order that has already been paid. This makes it possible for unauthenticated attackers, such as guest customers, to replace the items, shipping and totals of their own already-paid order with the contents of a new cart, which can leave the store holding a paid order for goods that were never paid for. Exploitation requires the one-step Klarna Express Checkout flow to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1711/
- https://plugins.svn.wordpress.org/klarna-payments-for-woocommerce/tags/4.13.5/
- https://wordpress.org/plugins/klarna-payments-for-woocommerce/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1711/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.