GHSA-H5GM-X9WR-VHCM Craft Commerce: Coupon Code Brute-Force via Rate Limit Bypass

Summary The CartController defines a RateLimiter behavior that is only activated when the 'number' POST/GET parameter is explicitly provided. Details When an attacker submits coupon codes against the session-based cart without passing a 'number' parameter, no rate limiting is applied. This allows...

Brute Force

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Brute Force in the actionUpdateCart process when the 'number' parameter is not provided, which disables rate limiting. An attacker can enumerate valid coupon codes by sending automated requests...

GHSA-78VR-Q6CF-C7P6 Craft Commerce: Partial Payment Amount Without Lower Bound Validation

Summary The Order::setPaymentAmount method accepts any float value without enforcing a minimum positive amount. The PaymentsController casts the user-supplied 'paymentAmount' parameter directly to float with no lower-bound check. Details When the store has 'Allow Partial Payment on Checkout'...

Improper Validation of Specified Quantity in Input

Overview craftcms/commerce is a Craft Commerce Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the Order::setPaymentAmount process. An attacker can bypass payment validation by submitting a zero or negative value for the paymentAmount...

CVE-2026-55795

creationtimestamp| type| source ---|---|--- 2026-06-16 05:04:11+00:00| published-proof-of-concept| https://github.com/craftcms/commerce/security/advisories/GHSA-h5gm-x9wr-vhcm...

CVE-2026-49775

Unauthenticated Broken Access Control in Welcart e-Commerce = 2.11.28 versions...

CVE-2026-42664

Unauthenticated Broken Access Control in AI Product Search for WooCommerce Motive Commerce Search = 1.38.2 versions...

CVE-2026-49775 WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Welcart e-Commerce = 2.11.28 versions...

EUVD-2026-36895

Unauthenticated Broken Access Control in Welcart e-Commerce = 2.11.28 versions...

CVE-2026-49775 WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Welcart e-Commerce = 2.11.28 versions...

CVE-2026-49775

CVE-2026-49775 affects WordPress Welcart e-Commerce plugin versions

CVE-2026-42664 WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AI Product Search for WooCommerce Motive Commerce Search = 1.38.2 versions...

EUVD-2026-36829

Unauthenticated Broken Access Control in AI Product Search for WooCommerce Motive Commerce Search = 1.38.2 versions...

CVE-2026-42664 WordPress AI Product Search for WooCommerce – Motive Commerce Search plugin <= 1.38.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in AI Product Search for WooCommerce Motive Commerce Search = 1.38.2 versions...

CVE-2026-42664

CVE-2026-42664 affects the WordPress plugin AI Product Search for WooCommerce – Motive Commerce Search, version

CVE-2026-49775: Missing Authorization

Unauthenticated Broken Access Control in Welcart e-Commerce = 2.11.28 versions...

CVE-2026-42664: Missing Authorization

Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search = 1.38.2 versions...

PT-2026-49455

Unauthenticated Broken Access Control in AI Product Search for WooCommerce Motive Commerce Search = 1.38.2 versions...

PT-2026-49345

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce versions prior to 2.11.29 Description Unauthenticated broken access control allows unauthorized users to bypass security restrictions. Recommendations Update to a version newer than 2.11.28...

EUVD-2022-56004

Cross-Site request forgery CSRF vulnerability in YITH YITH WooCommerce Product Slider Carousel allows Cross Site Request Forgery. This issue affects YITH WooCommerce Product Slider Carousel: from n/a through 1.16.0...