The Kliken: Ads + Pixel for Meta WordPress plugin has a flaw that prevents it from verifying that a visitor owns an order before presenting the details on the order confirmation page. This omission means anyone who can guess or enumerate order identifiers can see sensitive data about other customers, including billing locations, purchased items, and total amounts. The weakness is a classic Insecure Direct Object Reference, granting unauthorized access to protected order information. The impact is purely confidentiality loss for customers, without affecting the integrity or availability of the system.

The vulnerability appears in all installations of the Kliken: Ads + Pixel for Meta WordPress plugin whose version is older than 1.2.3. Versions 1.2.3 and newer include a fix that validates the order ownership before displaying the page. The affected systems therefore are sites running the plugin with a pre‑1.2.3 release on WordPress.

The CVSS score is 5.3, indicating moderate severity, while the EPSS score is < 1%, indicating a low likelihood of exploitation. The likely attack vector is via the public order confirmation URL, where an attacker supplies an order ID they do not own to retrieve another customer's order details. As the plugin fails to enforce ownership checks, any unauthenticated user can exploit this easily, making the risk significant for sites with many orders. The vulnerability is not listed in the CISA KEV catalog.