{
 "id": "WPSEC-2026-1860",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1860/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1860/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1860/index.md",
 "title": "Order Tracking <= 3.6.1 - Unauthenticated Insecure Direct Object Reference via Customer and Sales Rep Tracking Forms",
 "description": "The Order Tracking plugin for WordPress is vulnerable to Insecure Direct Object Reference via the customer and sales rep tracking forms and their AJAX lookups in all versions up to, and including, 3.6.1. This is due to missing validation on a user-controlled key: when neither Email Verification nor Require Login is enabled (the default Public mode), any customer or sales rep collection is authorized from the submitted customer or sales rep number alone. This makes it possible for unauthenticated attackers to enumerate customer or sales rep numbers and view the associated orders and personal data, such as names and email addresses, of other customers and sales reps.",
 "plugin": {
  "slug": "order-tracking",
  "name": "Order Tracking",
  "full_name": "Order Tracking – WordPress Status Tracking Plugin",
  "wordpress_org": "https://wordpress.org/plugins/order-tracking/",
  "advisories_url": "https://wpsec.com/vuln/plugin/order-tracking/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/order-tracking"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.6.2",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.6.2"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.6.2",
 "remediation": "Update to 3.6.2 or later.",
 "fix_released": "2026-10-27T17:03:04+00:00",
 "published": "2026-10-28T17:42:28+00:00",
 "updated": "2026-10-28T09:34:02.085864+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1860/",
  "https://plugins.svn.wordpress.org/order-tracking/tags/3.6.2/",
  "https://wordpress.org/plugins/order-tracking/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/order-tracking",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-28"
 }
}