Live › vulnerability › CVE-2026-118757
Go to dashboardPiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 has a missing authorization check in its update_fees AJAX handler. An unauthenticated attacker can reuse a nonce from their own order page and iterate order_id values to change payment methods, recalculate fees, and read other customers' order line items and totals.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 22:35 UTC. All times on this page are UTC.
Sites running the PiWeb Disable payment method / Partial payment for WooCommerce plugin before 1.1.10.9 with WooCommerce checkout, where customers pay for orders through the order-pay page. Stores without this plugin, or with it already on 1.1.10.9 or later, are not affected.
No product ranges from the sources yet.
wp plugin get <plugin-slug> --field=version (unknown exact slug from sources)1.1.10.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
This page as .md · .json · in your agent: get_signal("CVE-2026-118757")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.