klarnaplugin CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH klarnaplugin CVE published 2026-10-16

CVE-2026-110590

The Klarna for WooCommerce plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 4.13.3. This allows unauthenticated attackers to access any order's secret order_key and full billing and shipping PII, enabling full store-wide order enumeration with sequential GET requests to the order-pay endpoint. Defenders should assess exposure and prioritize remediation, fo [truncated]