CVE-2026-118757

Name of the Vulnerable Software and Affected Versions PiWeb Disable payment method / Partial payment for WooCommerce versions prior to 1.1.10.9

Description A missing authorization check in the update fees AJAX handler allows unauthenticated attackers to read and modify orders belonging to other customers. By reusing a nonce from their own order-pay page and providing sequential order id values, attackers can change payment methods, recalculate fees, and disclose order totals and line items.

Recommendations Update to version 1.1.10.9 or later.