Kliken
Monthly
Unauthenticated attackers can retrieve other customers' order details - billing location, purchased products, and totals - from WordPress sites running Kliken: Ads + Pixel for Meta before 1.2.3 by enumerating predictable order IDs. The flaw is an authorization bypass (CWE-639) rated CVSS 5.3 with only confidentiality impact, and publicly available exploit code exists. A vendor patch is available in version 1.2.3.
Unauthenticated attackers can retrieve other customers' order details - billing location, purchased products, and totals - from WordPress sites running Kliken: Ads + Pixel for Meta before 1.2.3 by enumerating predictable order IDs. The flaw is an authorization bypass (CWE-639) rated CVSS 5.3 with only confidentiality impact, and publicly available exploit code exists. A vendor patch is available in version 1.2.3.