CVE-2026-110590 Overview
CVE-2026-110590 is an authorization bypass vulnerability in the Klarna for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 4.13.3. The plugin fails to verify that a requester is authorized to access order data on the order-pay endpoint. Unauthenticated attackers can retrieve any order's order_key and complete billing and shipping personally identifiable information (PII), including first name, last name, email, phone number, street address, postcode, city, region, and country. The data is emitted inline as the klarna_payments_params JavaScript variable. Because WooCommerce order IDs are sequential integers, every order in a store can be enumerated with simple GET requests.
Critical Impact
Unauthenticated attackers can enumerate every order in a WooCommerce store and harvest full customer PII without credentials or session tokens.
Affected Products
- Klarna for WooCommerce plugin for WordPress — all versions through 4.13.3
- WordPress sites running WooCommerce with the vulnerable Klarna payments integration
- Patched in the commit referenced by WordPress plugin changeset 3740915
Discovery Timeline
- 2026-10-16 - CVE-2026-110590 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-110590
Vulnerability Analysis
The vulnerability resides in the plugin's asset enqueuing logic in classes/class-kp-assets.php. When the plugin prepares the order-pay checkout page, it loads order data and inlines it into a JavaScript object named klarna_payments_params. This object is rendered into the HTML response delivered to the browser.
The plugin does not confirm that the requesting user owns the order or possesses a valid order_key. Any unauthenticated visitor can request the order-pay endpoint for an arbitrary numeric order ID and receive the sensitive payload. The exposed fields include the secret order_key, which can grant further access to WooCommerce order management flows that trust that token.
Because WooCommerce assigns sequential integer order IDs, an attacker can script sequential GET requests across the full numeric range to extract every order record stored on the site.
Root Cause
The root cause is a missing authorization check, categorized as [CWE-862] Missing Authorization. The plugin treats presence on the order-pay URL as sufficient to receive the inlined order parameters. No ownership check, nonce validation, or order_key comparison is enforced before PII is serialized into the page.
Attack Vector
The attack vector is network-based and requires no authentication, no user interaction, and no privileges. An attacker iterates sequential order IDs against the order-pay endpoint and parses the HTML response to extract the klarna_payments_params JavaScript variable containing full customer records.
The vulnerability is described in prose only; see the Wordfence Vulnerability Report and the WordPress Class Asset Line 159 source reference for technical details.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-110590
Indicators of Compromise
- High volumes of unauthenticated GET requests to the WooCommerce order-pay endpoint with sequential or rapidly incrementing order ID parameters
- Responses containing the klarna_payments_params JavaScript variable served to clients without a valid session or order_key
- Single source IPs or distributed scrapers requesting checkout URLs across a wide range of order IDs in short time windows
Detection Strategies
- Review web server access logs for repeated requests to order-pay paths containing varying order IDs from the same client or ASN
- Alert on anomalous request-rate patterns against WooCommerce checkout endpoints, especially from unauthenticated sessions
- Hunt for outbound exfiltration of HTML pages containing klarna_payments_params structures to third-party collection endpoints
Monitoring Recommendations
- Enable verbose logging on the WordPress reverse proxy or Web Application Firewall for all /checkout/order-pay/ requests
- Monitor response sizes on the order-pay endpoint for sustained high-volume activity that may indicate scraping
- Correlate WooCommerce audit logs with web access logs to identify order IDs accessed without a corresponding authenticated session
How to Mitigate CVE-2026-110590
Immediate Actions Required
- Update the Klarna for WooCommerce plugin to a version containing WordPress changeset 3740915 or later
- Rotate exposed order_key values and notify customers whose PII may have been enumerated
- Deploy a WAF rule to block unauthenticated requests to the order-pay endpoint that lack a valid order_key query parameter
Patch Information
The vendor fix is published in WordPress Changeset 3740915. The code differences are visible in the GitHub Compare Changes view. The patch adds authorization validation before the plugin emits order-specific data into the klarna_payments_params JavaScript variable.
Workarounds
- Temporarily disable the Klarna for WooCommerce plugin until the patched release is applied
- Enforce WAF rules that require a matching order_key query parameter on all requests to the WooCommerce order-pay endpoint
- Restrict access to checkout endpoints from known scraper IP ranges and apply strict rate limiting on sequential order ID access patterns
# Example WAF rule concept - block order-pay requests missing order_key
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@rx /checkout/order-pay/[0-9]+" \
"chain,deny,status:403,msg:'Block CVE-2026-110590 enumeration'"
SecRule ARGS:key "@rx ^$"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
