Klarna for WooCommerce: Unauthenticated Store-Wide Order & PII Enumeration

Threat Overview

A high-severity authorization bypass in Klarna for WooCommerce allows unauthenticated actors to harvest secret order keys and customer Personally Identifiable Information (PII) across an entire WooCommerce store.

Tracked under CVE-2026-110590 (CVSS 7.5), the flaw affects versions up to and including 4.13.3. Because WooCommerce assigns sequential integer IDs to orders and the vulnerable code executes before verifying session ownership, automated bots can iterate through order numbers to scrape every customer’s full name, address, phone number, and email without logging in.

The Breakdown: How the Exploit Works

In a standard WooCommerce checkout flow, viewing or paying for an order on the order-pay endpoint requires the requester to match the authenticated customer session and supply the order’s cryptographic order_key token.

In Klarna for WooCommerce versions up to and including 4.13.3, class-kp-assets.php hooks into the order-pay lifecycle and outputs an inline JavaScript object (klarna_payments_params) directly into the HTML response before verifying that the visitor is logged in or holds a valid order_key.

That inline block embeds the secret order_key alongside the buyer’s billing and shipping profile: name, email, phone, and street address. Because WooCommerce stores orders as sequential post IDs (1001, 1002, 1003), an unauthenticated attacker can loop HTTP GET requests against order-pay to dump the store’s entire customer ledger.

The Operational Risk: What an Attacker Gains

• Bulk Customer PII Harvesting: Unauthenticated scrapers extract full names, home addresses, phone numbers, and emails for every customer who has placed an order.
• Secret order_key Compromise: Possession of the leaked order_key allows attackers to access protected order-status and receipt endpoints that rely on the key as a bearer token.
• Targeted Phishing & Fraud: Armed with exact order numbers and shipping addresses, threat actors launch convincing order-cancellation scams against buyers.
• Regulatory & Privacy Liability: Store-wide exposure of customer contact and address records triggers mandatory data-breach disclosure obligations under state and international privacy laws.

Our Take in Plain English

“Payment gateway plugins should be the most heavily guarded components on an ecommerce website. Yet on WooCommerce, payment extensions routinely inject customer data straight into page HTML so browser scripts can read it—and if the plugin runs one step too early in WordPress’s page lifecycle, it prints private customer addresses to anyone who guesses an order number. In a modern decoupled commerce architecture, payment tokens are negotiated server-to-server over authenticated APIs using non-sequential UUIDs, ensuring customer PII is never printed into public HTML.”

The Modern Architectural Remedy

• Legacy Dynamic WooCommerce: Uses predictable sequential integer post IDs for customer orders and relies on third-party PHP hooks to gate sensitive inline JavaScript output on public endpoints.
• Decoupled Pre-Rendered Commerce Architecture: Enforces strict API-level token authorization and cryptographic UUID order identifiers inside a dedicated commerce backend, keeping raw customer PII out of public page markup.

Immediate Action Items for WordPress Operators

1. Update Klarna Immediately: Upgrade klarna-payments-for-woocommerce to the latest patched version above 4.13.3.
2. Inspect Access Logs: Check web server logs for sequential HTTP GET requests targeting /checkout/order-pay/ URLs.
3. Apply Rate Limiting: Configure firewall rules to rate-limit unauthenticated requests to /checkout/order-pay/* and block requests missing ?key=wc_order_.
4. Assess Breach Duties: If logs confirm sequential scraping while version 4.13.3 or earlier was active, consult counsel regarding customer privacy notifications.