---
id: "CVE-2026-112071"
kind: "vulnerability"
aliases: ["CVE-2026-112071"]
title: "Order cancellation flaw lets any visitor cancel unpaid orders"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["ecommerce", "order-plugin", "other", "web-shop"]
not_affected_if: ["no-order-plugin-page", "orders-already-paid"]
published_at: "2026-10-20T10:17:04+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T03:40:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112071", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Order cancellation flaw lets any visitor cancel unpaid orders

The order cancellation function takes an order identifier from the request and does not check that the caller owns that order. Any site visitor can set unpaid orders to canceled.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- unknown

## Fix

- unknown

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112071

## From the sources

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_