{"id":"CVE-2026-112071","kind":"vulnerability","aliases":["CVE-2026-112071"],"related":[],"title":"Order cancellation flaw lets any visitor cancel unpaid orders","description":"The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to \"canceled\". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.","summary":"The order cancellation function takes an order identifier from the request and does not check that the caller owns that order. Any site visitor can set unpaid orders to canceled.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ecommerce","order-plugin","other","web-shop"],"not_affected_if":["no-order-plugin-page","orders-already-paid"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-20T10:17:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:40:32+00:00","updated_at":"2026-10-25T03:40:32+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-25T03:40:32Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Order cancellation flaw lets any visitor cancel unpaid orders","impact":"low","summary":"The order cancellation function takes an order identifier from the request and does not check that the caller owns that order. Any site visitor can set unpaid orders to canceled.","category":"other","nicknames":[],"who_cares":["ecommerce","order-plugin","web-shop"],"confidence":0.5,"needs_auth":"no","worst_case":"Any visitor cancels unpaid customer orders on the shop","analyst_note":"Find the plugin name, vendor, affected and fixed versions, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112071.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-order-plugin-page","orders-already-paid"],"who_is_affected":"Shops that run the order plugin on a page that is reachable by any visitor are exposed, since the flaw only applies when that page is present. Orders that were already paid are not affected, and sites without the order plugin on a page can skip it. The sources do not name the plugin, its versions or the vendor.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000551,"input_tokens":3298,"output_tokens":442,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112071':12A,15A '-2026':11A,14A 'accept':58C 'act':66C 'affect':108C 'alreadi':104C 'await':86C 'caller':41B,74C 'cancel':2A,7A,26B,53B,56C,89C 'check':38B,71C 'contain':95C 'cve':10A,13A 'ecommerc':16B 'flaw':3A 'function':27B,57C 'identifi':31B,61C 'let':4A 'order':1A,9A,18B,25B,30B,44B,51B,55C,60C,69C,82C,99C,101C 'order-plugin':17B 'own':42B,75C 'page':93C 'paid':105C 'payment':87C 'plugin':19B,100C 'request':34B,64C 'requir':91C 'set':49B,81C 'shop':23B,97C 'site':46B,78C 'still':85C 'take':28B 'unpaid':8A,50B 'visitor':6A,47B,79C 'web':22B 'web-shop':21B 'without':70C","nicknames":[],"mitigations":[],"who_affected":"Shops that run the order plugin on a page that is reachable by any visitor are exposed, since the flaw only applies when that page is present. Orders that were already paid are not affected, and sites without the order plugin on a page can skip it. The sources do not name the plugin, its versions or the vendor.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T10:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"f4fb688c-4412-4426-b4b8-421ecf27b14a","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112071","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112071","severity":null,"published_at":"2026-10-20T10:17:04+00:00","modified_at":"2026-10-20T19:28:52+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}