{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-124665", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-11-09T09:26:56.575Z", "datePublished": "2026-11-12T06:00:09.578Z", "dateUpdated": "2026-11-12T06:00:09.578Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-12T06:00:09.578Z"}, "title": "Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR", "problemTypes": [{"descriptions": [{"description": "CWE-639 Authorization Bypass Through User-Controlled Key", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "Order Tracking", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "3.6.2"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions."}], "references": [{"url": "https://wpscan.com/vulnerability/9165da1e-76b7-4364-9fd7-67ccb96afc48/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "V\u0169 Quang Huy", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Order Tracking", "vendor": "Unknown", "versions": [{"lessThan": "3.6.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions."}], "id": "CVE-2026-124665", "lastModified": "2026-11-12T06:17:13.627", "metrics": {}, "published": "2026-11-12T06:17:13.627", "references": [{"source": "[email protected]", "url": "https://wpscan.com/vulnerability/9165da1e-76b7-4364-9fd7-67ccb96afc48/"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received"}

{}

{}