CVE-2026-18603: 
WordPress vulnerability analysis and mitigation

CVE-2026-18603 is a missing authorization vulnerability in the PiWeb Cancel order / Refund request for WooCommerce WordPress plugin (also known as "Cancel Order & Request Woocommerce") affecting all versions before 1.3.4.34. The flaw allows unauthenticated users to disclose the contents of other customers' orders and manipulate logged-in users' shopping carts via crafted links. It was publicly disclosed on 2026-08-03 by researcher Shikhali Jamalzade and published to NVD on 2026-08-09. The vulnerability carries a CVSS score of 6.5 (Medium) and is classified under CWE-862 (Missing Authorization) (WPScan, Github Advisory).

The root cause is CWE-862 (Missing Authorization): the plugin's reorder AJAX actions do not perform authorization or ownership checks before adding the contents of a previous order to a user's cart. This means any unauthenticated HTTP request can reference an arbitrary order ID and trigger the reorder functionality, exposing order contents (items, quantities, potentially customer details) without verifying that the requester owns the order. Additionally, the same mechanism can be abused to clear and repopulate a logged-in user's cart by sending a crafted link, constituting both an information disclosure and an integrity violation. A proof-of-concept is scheduled for public release on 2026-08-17 to allow time for users to update (WPScan).

Successful exploitation allows unauthenticated attackers to enumerate and disclose the contents of any customer's past orders, potentially exposing purchased items, quantities, and associated order metadata. Attackers can also clear and repopulate the shopping cart of any currently logged-in user by tricking them into visiting a crafted URL, disrupting their shopping session and potentially causing unintended purchases. The primary impacts are confidentiality (order data exposure) and integrity (unauthorized cart manipulation), with no direct availability or remote code execution risk identified (WPScan, Github Advisory).

No public proof-of-concept exploit is currently available; WPScan has indicated the PoC will be released on 2026-08-17. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time. The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA KEV catalog. The attack requires no authentication and can be triggered via a crafted link, making it low-complexity once the PoC is public (WPScan, Github Advisory).

1. Reconnaissance: Identify WordPress sites running the "PiWeb Cancel order / Refund request for WooCommerce" plugin (slug: cancel-order-request-woocommerce) in a version below 1.3.4.34 using tools like WPScan or by checking plugin metadata at <target>/wp-content/plugins/cancel-order-request-woocommerce/.
2. Enumerate order IDs: WooCommerce order IDs are typically sequential integers. An attacker can guess or enumerate valid order IDs (e.g., starting from 1 and incrementing).
3. Craft malicious AJAX request: Send an unauthenticated HTTP request to the WordPress AJAX endpoint (e.g., wp-admin/admin-ajax.php) invoking the plugin's reorder action with a target order ID as a parameter, without providing any authentication credentials or nonce.
4. Disclose order contents: The server responds with the order's contents (items, quantities) without verifying ownership, exposing sensitive customer order data.
5. Cart manipulation (optional): Craft a URL containing the reorder action and a target order ID, then socially engineer a logged-in user into clicking it. This clears the victim's existing cart and repopulates it with the contents of the specified order (WPScan).

• Network: Unusual unauthenticated POST requests to wp-admin/admin-ajax.php with action parameters associated with the plugin's reorder/cancel functionality (e.g., containing cancel_order or reorder action names) originating from unknown or automated IP addresses.
• Logs: WordPress/web server access logs showing repeated requests to admin-ajax.php with varying order ID parameters from unauthenticated sessions (no valid session cookie or nonce); high volume of such requests may indicate enumeration.
• Application Behavior: Logged-in customers reporting unexpected cart contents being replaced or cleared without their action, which may indicate cart manipulation via crafted links.

Update the PiWeb Cancel order / Refund request for WooCommerce plugin to version 1.3.4.34 or later, which introduces proper authorization and ownership checks on the reorder AJAX actions. No official configuration-based workaround has been published; if immediate patching is not possible, consider temporarily deactivating the plugin until the update can be applied. Site administrators should also review WooCommerce order access logs for signs of unauthorized enumeration (WPScan, Github Advisory).

The vulnerability was discovered and submitted by researcher Shikhali Jamalzade (Twitter: @0xAlisAlive), who also maintains a Medium blog at alisalive.medium.com. WPScan verified the report and coordinated disclosure, scheduling the PoC release for 2026-08-17 to provide a remediation window. No significant broader media coverage or vendor statements beyond the WPScan advisory have been identified at this time (WPScan).