Kliken Ads Pixel CVE-2026-111596

Exploitation requires only that the affected site runs the Kliken: Ads + Pixel for Meta plugin at a version before 1.2.3 and exposes its order confirmation page, which is the plugin's normal function. The specific flaw is that the plugin outputs an order's details without verifying the visitor possesses that order's key, so an attacker simply needs valid/guessable order IDs to enumerate (order IDs are typically sequential and predictable). No authentication, user interaction, or non-default configuration is needed (PR:N/UI:N). The practical limiting factors are narrow: the target must have the vulnerable plugin installed and active, and the data exposed is read-only order information (billing location, products, totals) - no write access, account takeover, or system compromise is possible through this flaw.

Signals are largely consistent and point to a genuine but moderate-severity information-disclosure issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:L/I:N/A:N, score 5.3) matches the description precisely: a remote, unauthenticated attacker can read confidential order data with low attack complexity, but there is no integrity or availability impact, which caps severity in the medium range. The WordPress-specific nature (insecure direct object reference via order-ID enumeration, CWE-639) means exploitation is trivial to automate, and a public exploit exists (WPScan). No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation-probability and 'automatable' signals cannot be quantified from the input - this is a gap, not a low-risk indicator. The vulnerability is NOT in CISA KEV and shows no confirmed active exploitation; the risk is driven by publicly available exploit code plus ease of enumeration rather than observed in-the-wild use. Net assessment: a real priority for sites running the affected plugin because of unauthenticated reach and PII exposure, but bounded by its confidentiality-only impact and the plugin's limited deployment footprint.

An unauthenticated attacker visits the plugin's order confirmation page and iterates through sequential order IDs in the URL/parameters, since the plugin never checks that the visitor holds the matching order key. For each valid ID the page returns another customer's billing location, purchased products, and order totals, which the attacker scrapes in bulk. A public exploit is already available from WPScan, making mass enumeration straightforward.