Data Exposure in Kliken Ads + Pixel for Meta Plugin by WordPress
CVE-2026-111596
Currently unrated
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111596?
The Kliken: Ads + Pixel for Meta WordPress plugin versions prior to 1.2.3 lacks proper access control on the order confirmation page. This oversight allows unauthenticated users to view sensitive information such as billing locations and product details of other users' orders by manipulating order IDs. As a result, personal data is exposed, leading to potential privacy violations and targeted attacks.
Affected Version(s)
Kliken: Ads + Pixel for Meta 0 < 1.2.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.