Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint
high
The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to access any order's secret order_key...
- CVSS:
- 7.5
(Wordfence)
- Affected:
- up to 4.13.3
- Fixed in:
- 4.13.4
- Disclosed:
- Oct 15, 2026
CVE-2026-110590 on NVD →
Klarna Payments for WooCommerce <= 3.2.4 - Missing Authorization
medium
The Klarna Payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 3.2.4. This makes it possible for unauthenticated attackers to perform an unauthorized action.
- CVSS:
- 5.3
(Wordfence)
- Affected:
- up to 3.2.4
- Fixed in:
- 3.3.0
- Disclosed:
- Mar 28, 2024
CVE-2024-30477 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database