Klarna Order Management for WooCommerce <= 1.9.8 - Authenticated (Shop Manager+) Information Disclosure via Log Files
Strategic Overview
- Status
- Patched in 1.9.9
- Affected Plugin
- Klarna Order Management for WooCommerce
- Affected Version
<= 1.9.8- CVSS
- 2.7Low
- Weakness type
- CWE-117 · Improper Output Neutralization for Logs
- CVE
CVE-2025-58598
At a glance
CVE-2025-58598 is a low-severity Improper Output Neutralization for Logs vulnerability in the Klarna Order Management for WooCommerce WordPress plugin, affecting versions <= 1.9.8. It carries a CVSS score of 2.7 (reachable over the network; low attack complexity). Exploitation requires an authenticated account at Shop Manager level or above. The issue is fixed in version 1.9.9; sites on affected versions should update now. Disclosed September 2025, reported by Ananda Dhakal.
Vulnerability Overview
The Klarna Order Management for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.8 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the exposed log files.
Technical Analysis
The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no interaction from a victim user.
CWE-117: Improper Output Neutralization for Logs
The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes special elements when the message is written to a log file.
Remediation
Update to version 1.9.9, or a newer patched version
How does WordSec protect against this?
The fix is the thing that ends this: Klarna Order Management for WooCommerce 1.9.9 closes this, and updating the plugin is the step that ends it.
- Alerts
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C