CVE-2026-116745: Php Pii Order Reference Email In Redirect Without Secure Keycve-2026-116745-php-pii-order-reference-email-in-redirect-without-secure-key
Customer PII is disclosed through a redirect URL: the order reference ($ORDER->reference) and the customer e-mail are appended to a redirect link based only on a user-controlled identifier, without verifying the request's "key" parameter against $ORDER->secure_key. An unauthenticated attacker can iterate sequential cart/order ids and read the victim's order
