CVE-2026-112071

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The order cancellation function allows any site visitor to set orders awaiting payment to a canceled status. This occurs because the function accepts an order identifier from the request and processes it without verifying if the caller owns the order. This issue requires a page that includes the shop's order plugin. Orders that have already been paid are not affected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.