CVE-2026-18603 Overview
CVE-2026-18603 affects the PiWeb Cancel order / Refund request for WooCommerce WordPress plugin in versions before 1.3.4.34. The plugin fails to enforce authorization or ownership checks when adding the contents of a previous order to the cart. Unauthenticated attackers can craft a link that discloses the contents of other customers' orders. The same flaw lets attackers clear and repopulate a logged-in user's shopping cart. The vulnerability maps to [CWE-862] Missing Authorization and carries a network-based attack vector with low complexity.
Critical Impact
Unauthenticated attackers can disclose the contents of other customers' WooCommerce orders and manipulate a logged-in user's cart through a crafted link.
Affected Products
- PiWeb Cancel order / Refund request for WooCommerce WordPress plugin
- All versions before 1.3.4.34
- WooCommerce storefronts running the vulnerable plugin
Discovery Timeline
- 2026-08-09 - CVE-2026-18603 published to the National Vulnerability Database
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-18603
Vulnerability Analysis
The plugin exposes a feature that repopulates a customer's cart with the contents of a previous order. The handler accepts an order identifier from the request and loads the associated order items without verifying that the requester owns the target order. The response then returns the cart contents, and any browser session that follows the crafted link inherits the injected cart state. Because no authentication is required, an attacker can iterate order identifiers and enumerate the contents of arbitrary customer orders on the site. Attackers can also weaponize the flaw against authenticated shoppers by sending a link that clears the victim's active cart and replaces it with attacker-chosen products, disrupting checkout flow and leaking browsing behavior.
Root Cause
The root cause is missing authorization logic in the endpoint that rebuilds the cart from a prior order. The plugin does not compare the order's owner against the current user, nor does it require a valid nonce tied to the requesting session. This maps directly to [CWE-862] Missing Authorization.
Attack Vector
Exploitation is remote and unauthenticated. An attacker distributes a crafted URL that references a target order identifier. Victims who follow the link, or attackers scripting requests directly, trigger the vulnerable endpoint and receive the order contents or overwrite the current cart state. No user interaction is required to enumerate orders programmatically. See the WPScan Vulnerability Report for the technical write-up.
Detection Methods for CVE-2026-18603
Indicators of Compromise
- Bursts of unauthenticated HTTP GET requests iterating sequential order identifiers against the plugin's cart-repopulation endpoint.
- Unusual wc_cart or session cookie changes for authenticated users immediately after following an external link.
- Web server access logs containing plugin action parameters referencing previous-order retrieval without an authenticated session cookie.
Detection Strategies
- Review WooCommerce order access logs for unauthenticated requests that reference order IDs the visitor does not own.
- Alert on high-rate scanning of the plugin endpoint from a single client IP or user agent.
- Correlate cart modification events with off-site HTTP referrers to identify link-driven manipulation.
Monitoring Recommendations
- Enable verbose access logging for /?wc-ajax= and plugin-specific action parameters, then forward logs to a centralized SIEM.
- Monitor for anomalous 200-response volumes on the plugin's cart endpoint over short time windows.
- Track WordPress user session activity for unexpected cart state transitions.
How to Mitigate CVE-2026-18603
Immediate Actions Required
- Update the PiWeb Cancel order / Refund request for WooCommerce plugin to version 1.3.4.34 or later.
- If patching is delayed, deactivate the plugin until the update is applied.
- Audit recent access logs for evidence of order enumeration against the vulnerable endpoint.
Patch Information
The vendor addressed the flaw in version 1.3.4.34 by adding ownership verification before loading a previous order into the cart. Administrators should upgrade through the WordPress plugin dashboard or by replacing plugin files with the patched release. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Block unauthenticated requests to the plugin's cart-repopulation endpoint at the web application firewall.
- Restrict access to the plugin's action parameters using WordPress role checks or a custom must-use plugin until the patch is applied.
- Rotate WooCommerce session cookies and clear active carts after applying the update to invalidate any manipulated state.
# Example WAF rule to block unauthenticated access to the vulnerable endpoint
# Adjust the action parameter to match the plugin's exposed handler
SecRule REQUEST_URI "@rx (?i)wc-ajax=.*piweb.*order" \
"id:1026186031,phase:1,deny,status:403,log,msg:'Blocked PiWeb cart repopulation attempt (CVE-2026-18603)'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
