CVE-2026-92436 Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

EUVD-2026-87896

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

CVE-2026-92436 Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

CVE-2026-92436

The Mailchimp for WooCommerce WordPress plugin (versions before 6.3 ) is vulnerable to an Insecure Direct Object Reference (IDOR) . The application fails to require authentication or verify ownership when loading a saved cart from a request-supplied identifier derived from a customer's email addr...

PT-2026-99532

Name of the Vulnerable Software and Affected Versions Event Gallery versions prior to 6.5.0 Description Cross-Site Request Forgery CSRF exists in various cart actions within the extension. CSRF is a type of attack that tricks a victim into submitting a malicious request. It occurs when an...

PT-2026-99501

Name of the Vulnerable Software and Affected Versions Mailchimp for WooCommerce WordPress plugin versions prior to 6.3 Description An issue exists where the plugin fails to require authentication or verify ownership when loading a saved cart. An unauthenticated attacker who possesses a customer's...

CVE-2026-100872: Insufficient Verification of Data Authenticity

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to modify order totals after gateway transaction initiation. Attackers can pay a small amount, enlarge the order after gateway capture, and have the system mark t...

CVE-2026-100748: Cross-Site Request Forgery (CSRF)

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension 6.5.0...

CVE-2026-92436: Authorization Bypass Through User-Controlled Key

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier that is derived from a customer's email address, allowing an unauthenticated attacker who knows a customer's email address t...

PT-2026-99542

Name of the Vulnerable Software and Affected Versions Sylius versions prior to 2.1.16 Sylius versions prior to 2.2.9 Description An issue exists where payment amounts are not validated during cart recalculation. This allows unauthenticated attackers to modify order totals after a gateway...

PT-2026-98393

Name of the Vulnerable Software and Affected Versions Premium Packages – Sell Digital Products Securely versions prior to 7.2.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where malicious...

Spree: Broken Access Control in `PATCH /api/v3/store/carts/:id/associate` (IDOR)

Summary The Store API v3 endpoint PATCH /api/v3/store/carts/:id/associate binds a guest cart to the authenticated caller without verifying possession of that cart. It locates the cart by prefixed ID only — currentstore.carts.whereuser: nil, currentuser.findbyprefixid!params:id — and omits the...

CVE-2026-94462

The open source e-commerce solution Spree is vulnerable to a broken access control (IDOR) issue in versions 5.4.0 through 5.4.4 and 5.5.4 . The vulnerability exists in the Spree::Api::V3::Store::CartsController#associate method, where the PATCH /api/v3/store/carts/:id/associate endpoint uses find...

EUVD-2026-84794

Spree is an open source e-commerce solution built with Ruby on Rails. From 5.4.0 until 5.4.4 and 5.5.4, PATCH /api/v3/store/carts/:id/associate in Spree::Api::V3::Store::CartsControllerassociate uses findcartforassociation to locate a cart by prefixedid but does not require a cart token or...

PT-2026-97017

Name of the Vulnerable Software and Affected Versions Spree versions 5.4.0 through 5.4.3 Spree versions 5.5.0 through 5.5.3 Description An authenticated customer can associate an eligible guest cart with their own account and access the billing and shipping address data stored within that cart...

CVE-2026-85010 RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero...

CVE-2026-85010

CVE-2026-85010 affects the RestroPress WordPress plugin prior to version 3.4.6 . The plugin fails to validate client-supplied item add-on prices on the server side when items are added to or updated in the cart. This allows unauthenticated attackers to manipulate prices arbitrarily, placing order...

EUVD-2026-83867

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero...

CVE-2026-85010 RestroPress < 3.4.6 - Unauthenticated Price Manipulation via Cart Add-ons

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero...

CVE-2026-85350 UpsellWP < 2.2.10 - Unauthenticated Price Manipulation via Frequently Bought Together

The UpsellWP WordPress plugin before 2.2.10 does not check that products added to the cart through a Frequently Bought Together campaign belong to that campaign, allowing unauthenticated users to buy arbitrary products at the campaign's discounted price...