Order Tracking <= 3.6.1 - Unauthenticated Insecure Direct Object Reference via Customer and Sales Rep Tracking Forms
- ID
- WPSEC-2026-1860
- Plugin
- Order Tracking – WordPress Status Tracking Plugin (order-tracking)
- Affected
- all versions before 3.6.2
- Remediation
- Update to 3.6.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-28
- Attack surface
- Order Tracking on WPSec AttackSurface
- Fix released
- Published
Description
The Order Tracking plugin for WordPress is vulnerable to Insecure Direct Object Reference via the customer and sales rep tracking forms and their AJAX lookups in all versions up to, and including, 3.6.1. This is due to missing validation on a user-controlled key: when neither Email Verification nor Require Login is enabled (the default Public mode), any customer or sales rep collection is authorized from the submitted customer or sales rep number alone. This makes it possible for unauthenticated attackers to enumerate customer or sales rep numbers and view the associated orders and personal data, such as names and email addresses, of other customers and sales reps.
References
- https://wpsec.com/vuln/WPSEC-2026-1860/
- https://plugins.svn.wordpress.org/order-tracking/tags/3.6.2/
- https://wordpress.org/plugins/order-tracking/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS