WordPress WPCafe plugin 3.0.10-3.0.17 - Unauthenticated Order Disclosure and Modification vulnerability

Unauthenticated Order Disclosure and Modification vulnerability discovered by Artus KG in WordPress Plugin WPCafe versions 3.0.10-3.0.17...

CVE-2026-86812 WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...

CVE-2026-86812

The WPCafe WordPress plugin versions 3.0.10 through 3.0.17 is vulnerable to improper access control. The root cause is that permission callbacks for certain order-management REST endpoints return an incorrect type upon failure, failing to properly restrict access. This allows unauthenticated user...

CVE-2026-86812 WPCafe 3.0.10 - 3.0.17 - Unauthenticated Order Disclosure and Modification via food-orders REST API

The WPCafe WordPress plugin before 3.0.18 does not correctly restrict access to a set of order-management REST endpoints because their permission callbacks return an incorrect type on failure, allowing unauthenticated users to disclose guest order information and to change the status of, or trash...

CVE-2026-13177

The Eventin WordPress plugin (versions prior to 4.1.20 ) is vulnerable to an IDOR (Insecure Direct Object Reference) vulnerability. The software fails to properly restrict access to individual order records, which allows users with contributor-level access or higher to read other customers' order...

CVE-2026-13177 Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-18603 Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clea...

CVE-2026-18603 Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clea...

CVE-2026-16039 MStore API < 4.21.0 - Subscriber+ Order and Customer PII Disclosure via IDOR

The MStore API WordPress plugin before 4.21.0 does not restrict its vendor-orders endpoint to the caller's own orders, allowing any authenticated user, including Subscribers, to read every WooCommerce order in the store together with each customer's personal information...

EUVD-2026-27050

Easy PayPal Events & Tickets plugin for WordPress versions 1.3 and earlier contain an information disclosure vulnerability in the QR code scanning endpoint that allows unauthenticated attackers to enumerate and retrieve all customer order records. Attackers can iterate over sequential WordPress...

WordPress iPaymu Payment Gateway for WooCommerce plugin <= 2.0.2 - Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure vulnerability

Missing Authentication to Unauthenticated Payment Bypass and Order Information Disclosure vulnerability discovered by Teerachai Somprasong in WordPress Plugin iPaymu Payment Gateway for WooCommerce versions = 2.0.2...

CVE-2022-48506

A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct ICP and ICP2 and ImageCast Evolution ICE scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of...