CVE-2026-18603

Name of the Vulnerable Software and Affected Versions PiWeb Cancel order / Refund request for WooCommerce WordPress plugin versions prior to 1.3.4.34

Description Lack of authorization and ownership checks when adding previous order contents to the cart allows unauthenticated users to disclose the contents of other customers' orders. Additionally, an attacker can clear and repopulate the cart of a logged-in user through a crafted link.

Recommendations Update PiWeb Cancel order / Refund request for WooCommerce WordPress plugin to version 1.3.4.34 or later.