Authorization Bypass in Klarna for WooCommerce Plugin

CVE-2026-110590

What is CVE-2026-110590?

The Klarna for WooCommerce plugin for WordPress contains a critical oversight in its authorization checks, allowing unauthorized users to exploit the system. This vulnerability makes it possible for attackers to bypass authorization checks and access sensitive user information, including billing and shipping details, linked to an order. By leveraging the sequential nature of WooCommerce order IDs, attackers can easily enumerate all orders in a store by sending unprotected GET requests to the order-pay endpoint. The sensitive data emitted through the klarna_payments_params JavaScript variable poses a significant risk by exposing personal information like names, addresses, and contact information. Users of this plugin must implement the fixes provided in the latest versions to mitigate potential risks.

References