CVE-2026-124665— Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Quick assessment

Affected

Unknown Order Tracking

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 3.6.2 版本之前的 Order Tracking WordPress 插件未验证访客是否拥有其请求订单的顾客或销售代表账户，且账户编号默认采用顺序值，导致未认证用户可以获取所有顾客和销售代表的订单历史记录；在某些版本中，甚至可获取订单联系邮箱地址。

AI Predicted 7.5 Difficulty: Trivial Updated Nov 12, 2026

Possible ATT&CK Techniques 2 AI

T1086 T1190 · Exploit Public-Facing Application

Updated Nov 12, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

Source: CVE Program / CVE List V5

Vulnerability Description

The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Unknown	Order Tracking	0 ~ 3.6.2	-

II. Public POCs for CVE-2026-124665

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-124665

请登录查看更多情报信息。

Other References for CVE-2026-124665 (1)

https://wpscan.com/vulnerability/9165da1e-76b7-4364-9fd7-67ccb96afc48/ exploit vdb-entry technical-description

https://www.cve.org/CVERecord?id=CVE-2026-124665

Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total

CVE-2026-122003		Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF
CVE-2026-110072		Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr
CVE-2026-110041		Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E
CVE-2026-106027		Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v
CVE-2026-110959		Descope < 1.2.0 - Unauthenticated Account Takeover
CVE-2026-119039		Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti
CVE-2026-118421		WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter
CVE-2026-118531		Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update
CVE-2026-123044		ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure
CVE-2026-119040		Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification
CVE-2026-76792		User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L
CVE-2026-121498		Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR
CVE-2026-123092		WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio
CVE-2026-124652		Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR
CVE-2026-124653		Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure
CVE-2026-124647		TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie
CVE-2026-124648		TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key
CVE-2026-124815		Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions
CVE-2026-124814		Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't
CVE-2026-124817		Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification

IV. Related Vulnerabilities

Same product: Order Tracking

Same vendor: Unknown