This vulnerability arises from a missing authorization check in Klarna for WooCommerce, allowing attackers to access an order's secret key and full billing and shipping personal data without authentication. The flaw results in the exposure of sensitive information such as name, email, phone number, and address embedded within an inline JavaScript variable. The weakness is a classic example of an authorization bypass, classified as CWE‑862.

The issue affects all Klarna for WooCommerce plugin versions up to and including 4.13.3, which runs on WordPress sites that utilize WooCommerce. Attackers can target the order‑pay endpoint, which processes sequential order IDs without requiring an authenticated session. As a consequence, any order in the store can be enumerated and its sensitive details disclosed.

With a CVSS score of 7.5, this flaw presents moderate to high risk, and the EPSS score is not available, indicating a lack of public exploitation data. While the plugin is not listed in CISA's KEV catalog, the exploitation conditions are simple: a public, unauthenticated HTTP GET request to a predictable endpoint. The combination of sequential order IDs and non‑restricted endpoint access enables widespread enumeration and data leakage across all orders in the store.