Klarna for WooCommerce EUVD-2026-102650

No special conditions beyond having the Klarna for WooCommerce plugin (version ≤4.13.3) installed and active on a WordPress/WooCommerce store, with the order-pay endpoint publicly reachable as in a default storefront. Exploitation is remote and fully unauthenticated (PR:N) with no user interaction, and relies on WooCommerce's default sequential integer order IDs so no valid order_key or session is needed. The only practical limiting factors are that the store must run an affected version and expose checkout/order-pay pages publicly; there is no non-default configuration or privilege requirement that constrains an attacker.

This is a genuine, high-priority information-disclosure flaw rather than an inflated high-CVSS issue, because every exploitation signal aligns with easy mass abuse. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N) is fully consistent with the description: remote, network-reachable, no authentication (PR:N), no user interaction, and low complexity. The impact profile (C:H/I:N/A:N) correctly reflects confidentiality-only harm - bulk exposure of order secret keys and billing/shipping PII - with no integrity or availability effect. The description reinforces that complexity is genuinely low: WooCommerce order IDs are sequential integers and no order_key or session is needed, so the entire order table can be enumerated with scripted sequential GET requests, which maps closely to an SSVC 'automatable=yes' condition and a 'partial' technical impact (data read, not full control). No EPSS score, CISA KEV entry, or public POC is present in the supplied data, so exploitation is inferred from exploitability - not confirmed in the wild. The key tension to note: despite being trivially automatable, there is no KEV listing and no EPSS figure provided here, so real-world exploitation volume is currently unquantified and should be treated as high-potential but unconfirmed. Overall, prioritize patching for any store running this plugin, as the barrier to abuse is near-zero.

An unauthenticated attacker points a script at the store's order-pay endpoint and iterates sequential order IDs, scraping the klarna_payments_params JavaScript variable from each response to harvest every order's secret order_key plus full billing and shipping PII (name, email, phone, address). Because no authentication, session, or valid order_key is required and complexity is low (AV:N/AC:L/PR:N/UI:N), the entire customer database can be enumerated in a single automated sweep. No public exploit is identified at time of analysis, but the technique requires only basic HTTP scripting.