CVE-2026-124665
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 12, 2026
Vendor
unknown
Description
The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions.