Klarna for WooCommerce (<= 4.13.3) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/klarna-for-woocommerce--4.13.3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 16 Oct 2026 06:25:56 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in Klarna for WooCommerce Pluginhttps://feed.craftedsignal.io/briefs/2026-10-klarna-woocommerece-auth-bypass/Fri, 16 Oct 2026 06:25:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-klarna-woocommerece-auth-bypass/An authorization bypass vulnerability in the Klarna for WooCommerce plugin allows unauthenticated attackers to enumerate store orders and exfiltrate customer PII via the order-pay endpoint.The Klarna for WooCommerce plugin for WordPress, in versions up to and including 4.13.3, contains a critical authorization bypass vulnerability (CVE-2026-110590). The flaw stems from the plugin's failure to verify user authorization before returning order details. Unauthenticated attackers can exploit this by sending crafted GET requests to the WooCommerce order-pay endpoint. The server responds by emitting sensitive customer PII - including full names, email addresses, phone numbers, and physical billing/shipping addresses - directly into the HTML source code within the 'klarna_payments_params' JavaScript variable. Because WooCommerce utilizes sequential integer-based order IDs, an attacker can trivially enumerate every order in a vulnerable store without needing authentication or a valid 'order_key'. This vulnerability poses a significant risk for mass data harvesting and privacy breaches for any merchant utilizing this plugin.

Attack Chain

  1. Attacker identifies a WordPress site running the Klarna for WooCommerce plugin (version <= 4.13.3).
  2. Attacker probes the '/checkout/order-pay/' endpoint to confirm accessibility.
  3. Attacker uses an automated script to increment sequential order IDs (e.g., /checkout/order-pay/1001, /checkout/order-pay/1002).
  4. The vulnerable plugin processes the request without validating if the current session belongs to the order owner.
  5. The server returns a 200 OK response containing the order page HTML.
  6. Attacker scrapes the 'klarna_payments_params' JavaScript variable from the response body.
  7. Attacker extracts PII (names, addresses, email, phone) from the scraped JSON-formatted variable.
  8. Attacker compiles the enumerated records for exfiltration.

Impact

Successful exploitation allows an unauthenticated attacker to scrape the entire order history of a WooCommerce store. This results in the exposure of extensive customer PII, including names, contact information, and physical addresses. With the increasing reliance on e-commerce, such a mass-data leak impacts customer privacy, violates compliance requirements (such as GDPR or CCPA), and can lead to secondary phishing or fraud attacks against the affected customers.

Recommendation

  • Update the Klarna for WooCommerce plugin to the latest version (patch for CVE-2026-110590) immediately.
  • Monitor web server logs for high-frequency GET requests to '/checkout/order-pay/' originating from single IP addresses.
  • Review web application firewall (WAF) logs for unauthorized access to order-pay paths and set rate-limiting policies for these endpoints.
  • Deploy the Sigma rule below to detect automated enumeration attempts against the checkout/order-pay infrastructure.
]]>highadvisoryweb-applicationprivacyvulnerability