CVE-2026-111596: Kliken: Ads + Pixel for Meta 0 to before 1.2.3

Affected technology

Kliken: Ads + Pixel for Meta · 0 to before 1.2.3
Vendor not specified by the source

Description’s affected range: before 1.2.3 does not verify that a visitor holds an order's key before outputting that order's details on the order confirmation page

Component: Not specified by the source

What an attacker can do

Unauthenticated users can retrieve the billing location, purchased products and totals of other customers' orders by enumerating order IDs.