Klarna Checkout for WooCommerce < 2.13.5 - DoS via Excessive Logging
Priority HIGH 72Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
The Klarna Checkout for WooCommerce WordPress plugin before 2.13.5 exposes an unauthenticated WooCommerce Ajax endpoint that allows an attacker to flood the log files with data at the maximum size allowed for a POST parameter per request. This can result in rapid consumption of disk space, potentially filling the entire disk.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00512 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix Fixed Klarna Checkout for WooCommerce (Unknown): 2.13.5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Klarna Checkout for WooCommerce | before 2.13.5 | 2.13.5 | Patch available | CNA |
- Klarna Checkout for WooCommerce VendorUnknown Affected before 2.13.5 Fixed in 2.13.5 Patch available CNA
Remediation
- Fix · CNA Klarna Checkout for WooCommerce (Unknown) Fixed in 2.13.5
Timeline
- 2026-10-02 Threatist record created from CVE-2024-13925
- 2026-10-03 Alias added: GHSA-m6j5-92q7-225w
References
Sources
- CVE-2024-13925 · CVE Program
- CVE-2024-13925 · NVD
- FIRST EPSS
- GHSA-m6j5-92q7-225w · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences