CVE-2026-118757 Details
Description
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
A missing authorization vulnerability has been identified in the PiWeb Disable Payment Method / Partial Payment for WooCommerce plugin, affecting versions prior to 1.1.10.9. The vulnerability resides in the update_fees AJAX handler, where unauthenticated attackers can manipulate and access other customers' orders. Exploitation involves reusing a nonce from the attacker's own order-pay page and providing sequential order_id values to alter payment methods, recalculate fees, and reveal order line items and totals.
Users are advised to update the PiWeb Disable Payment Method / Partial Payment for WooCommerce plugin to version 1.1.10.10 or later.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| PiWeb Disable payment method | >= 0, < 1.1.10.9 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |