# Order Tracking <= 3.6.1 - Unauthenticated Insecure Direct Object Reference via Customer and Sales Rep Tracking Forms

- **ID:** WPSEC-2026-1860
- **Plugin:** Order Tracking – WordPress Status Tracking Plugin (`order-tracking`), https://wordpress.org/plugins/order-tracking/
- **Affected versions:** all versions before 3.6.2
- **Fixed in:** 3.6.2 (Update to 3.6.2 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/order-tracking
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1860/

## Description

The Order Tracking plugin for WordPress is vulnerable to Insecure Direct Object Reference via the customer and sales rep tracking forms and their AJAX lookups in all versions up to, and including, 3.6.1. This is due to missing validation on a user-controlled key: when neither Email Verification nor Require Login is enabled (the default Public mode), any customer or sales rep collection is authorized from the submitted customer or sales rep number alone. This makes it possible for unauthenticated attackers to enumerate customer or sales rep numbers and view the associated orders and personal data, such as names and email addresses, of other customers and sales reps.

## References

- https://wpsec.com/vuln/WPSEC-2026-1860/
- https://plugins.svn.wordpress.org/order-tracking/tags/3.6.2/
- https://wordpress.org/plugins/order-tracking/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1860/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.