Description

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clear and repopulate a logged in user's cart via a crafted link.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-09T06:19:12.483Z",
  "pubdate": "2026-08-09T06:19:12.483Z",
  "executiveSummary": "An authorization and ownership validation vulnerability exists in the PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before version 1.3.4.34. The flaw allows unauthenticated threat actors to interact with arbitrary customer order data by adding the contents of a previous order directly into a shopping cart. The risk implications include unauthorized disclosure of sensitive customer order contents and the capability to manipulate the shopping cart state of authenticated users. An attacker can exploit this vulnerability externally over the network without requiring any prior authentication or special privileges, simply by crafting and inducing a victim or executing a direct request leveraging predictable functionality. This compromises data confidentiality and integrity within the e-commerce environment.",
  "technicalDetails": "The root cause of the vulnerability stems from a complete lack of access control checks, specifically missing authorization and ownership validation, within the order-to-cart cart population mechanism of the PiWeb Cancel order / Refund request for WooCommerce WordPress plugin. When processing requests involving previous order contents, the underlying code fails to verify whether the session executing the request actually owns the target order ID being referenced.\nThe vulnerability affects all versions of the PiWeb Cancel order / Refund request for WooCommerce plugin prior to version 1.3.4.34. The affected component handles the routine of transferring or appending items from historical order records back into active shopping cart sessions. Because the software does not enforce proper object-level authorization checks, the exposure is fully network-accessible and exploitable by unauthenticated remote attackers.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies or guesses valid target order identifiers within the WooCommerce database. Second, the attacker crafts a malicious link or direct HTTP request designed to invoke the vulnerable plugin functionality, passing the arbitrary target order ID as a parameter. Third, when the request is processed—either directly by the attacker or indirectly via a crafted link delivered to an authenticated user—the application fails to validate the context and proceeds to clear the current cart and repopulate it with the contents of the specified foreign order.\nPost-exploitation impact encompasses two distinct vectors. In the disclosure scenario, the attacker can leverage the mechanism to inspect or infer the contents of other customers' orders. In the state-manipulation scenario, an attacker can target a logged-in user with a crafted link, causing the victim's active cart to be unexpectedly cleared and replaced with arbitrary items, resulting in a denial of service for legitimate checkout flows or forcing unintended items into the victim's session."
}