Authorization Flaw in WooCommerce Plugin for WordPress Allows Unauthorized Access to Order Details
CVE-2026-18603
Currently unrated
What is CVE-2026-18603?
The PiWeb Cancel order/Refund request feature in the WooCommerce plugin for WordPress versions prior to 1.3.4.34 lacks essential authorization checks. This vulnerability enables unauthenticated users to access and disclose the contents of other customers' orders without permission. Moreover, it allows these users to modify the cart of logged-in users via malicious links, potentially leading to significant privacy violations and data exposure within an online shopping context.
Affected Version(s)
PiWeb Cancel order / Refund request for WooCommerce 0 < 1.3.4.34
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.