Order Tracking CVEs and Security Vulnerabilities

CVE-2026-121633

Order Tracking < 3.6.0 - Unauthenticated Payment Confirmation Forgery via PayPal IPN Listener

The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Order Tracking

CVE-2026-124665

Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure via IDOR

The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales representative account whose orders they request, and the account numbers default to sequential values, allowing unauthenticated users to retrieve the order history of every customer and sales representative, including order contact email addresses in some versions.