Missing Authorization Vulnerability in PiWeb WooCommerce Payment Method
CVE-2026-118757

6.9MEDIUM

Key Information:

Vendor

Pi Websolution

Status
Piweb Disable Payment Method / Partial Payment For WooCommerce
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118757?

The PiWeb Disable Payment Method plugin for WooCommerce prior to version 1.1.10.9 contains a significant missing authorization vulnerability. This flaw exists within the update_fees AJAX handler and potentially allows unauthenticated attackers to manipulate and read other customers' orders. By exploiting this vulnerability, attackers can reuse a nonce from their own order-pay page and send sequential order_id values, enabling them to change payment methods, recalculate order fees, and disclose sensitive order line items and totals. This exposes customers to risks and undermines the integrity of transaction processes in WooCommerce.

Affected Version(s)

PiWeb Disable payment method / Partial payment for WooCommerce 0 < 1.1.10.9

References

https://plugins.svn.wordpress.org/disable-payment-method-...
technical-description
https://plugins.trac.wordpress.org/changeset/3751777/disa...
patch
https://wordpress.org/plugins/disable-payment-method-for-...
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

pnn219
.