{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aklarnaklarna_for_woocommercewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:klarna:klarna_for_woocommerce:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-110590"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Klarna for WooCommerce (\u003c= 4.13.3)"],"_cs_severities":["high"],"_cs_tags":["web-application","privacy","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Klarna"],"content_html":"\u003cp\u003eThe Klarna for WooCommerce plugin for WordPress, in versions up to and including 4.13.3, contains a critical authorization bypass vulnerability (CVE-2026-110590). The flaw stems from the plugin's failure to verify user authorization before returning order details. Unauthenticated attackers can exploit this by sending crafted GET requests to the WooCommerce order-pay endpoint. The server responds by emitting sensitive customer PII - including full names, email addresses, phone numbers, and physical billing/shipping addresses - directly into the HTML source code within the 'klarna_payments_params' JavaScript variable. Because WooCommerce utilizes sequential integer-based order IDs, an attacker can trivially enumerate every order in a vulnerable store without needing authentication or a valid 'order_key'. This vulnerability poses a significant risk for mass data harvesting and privacy breaches for any merchant utilizing this plugin.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies a WordPress site running the Klarna for WooCommerce plugin (version \u0026lt;= 4.13.3).\u003c/li\u003e\n\u003cli\u003eAttacker probes the '/checkout/order-pay/' endpoint to confirm accessibility.\u003c/li\u003e\n\u003cli\u003eAttacker uses an automated script to increment sequential order IDs (e.g., /checkout/order-pay/1001, /checkout/order-pay/1002).\u003c/li\u003e\n\u003cli\u003eThe vulnerable plugin processes the request without validating if the current session belongs to the order owner.\u003c/li\u003e\n\u003cli\u003eThe server returns a 200 OK response containing the order page HTML.\u003c/li\u003e\n\u003cli\u003eAttacker scrapes the 'klarna_payments_params' JavaScript variable from the response body.\u003c/li\u003e\n\u003cli\u003eAttacker extracts PII (names, addresses, email, phone) from the scraped JSON-formatted variable.\u003c/li\u003e\n\u003cli\u003eAttacker compiles the enumerated records for exfiltration.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to scrape the entire order history of a WooCommerce store. This results in the exposure of extensive customer PII, including names, contact information, and physical addresses. With the increasing reliance on e-commerce, such a mass-data leak impacts customer privacy, violates compliance requirements (such as GDPR or CCPA), and can lead to secondary phishing or fraud attacks against the affected customers.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Klarna for WooCommerce plugin to the latest version (patch for CVE-2026-110590) immediately.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for high-frequency GET requests to '/checkout/order-pay/' originating from single IP addresses.\u003c/li\u003e\n\u003cli\u003eReview web application firewall (WAF) logs for unauthorized access to order-pay paths and set rate-limiting policies for these endpoints.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule below to detect automated enumeration attempts against the checkout/order-pay infrastructure.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T06:25:56Z","date_published":"2026-10-16T06:25:56Z","id":"https://feed.craftedsignal.io/briefs/2026-10-klarna-woocommerece-auth-bypass/","summary":"An authorization bypass vulnerability in the Klarna for WooCommerce plugin allows unauthenticated attackers to enumerate store orders and exfiltrate customer PII via the order-pay endpoint.","title":"Authorization Bypass in Klarna for WooCommerce Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-klarna-woocommerece-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:klarna:klarna_for_woocommerce:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}