WordPress PayPlug for WooCommerce (Official) plugin 2.9.0-3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation vulnerability

Unauthenticated Order Key Disclosure and Order Cancellation vulnerability discovered by Filip Kecman in WordPress Plugin PayPlug for WooCommerce Official versions 2.9.0-3.1.0...

CVE-2026-110292 PayPlug for WooCommerce 2.9.0 - 3.1.0 - Unauthenticated Order Key Disclosure and Order Cancellation via payplug_create_intent

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...

CVE-2026-110292

The PayPlug for WooCommerce (Official) WordPress plugin, in versions before 3.1.1 , is vulnerable to an unauthenticated order key disclosure and order cancellation. The flaw exists because the plugin fails to verify requester ownership of a WooCommerce order specified in a payment request via the...

CVE-2026-110292: Unknown PayPlug for WooCommerce (Official): The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not verify that the requester owns the…

The PayPlug for WooCommerce Official WordPress plugin before 3.1.1 does not verify that the requester owns the WooCommerce order named in a payment request, allowing unauthenticated users to disclose another customer's order key and cancel their unpaid guest order...

WordPress Mintpay for WooCommerce plugin <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation vulnerability

Unauthenticated Order Payment Completion and Cancellation vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Mintpay for WooCommerce versions = 2.2.3...

TYPO3 Shop by coding.ms 6.2.0 Unauthenticated Order Cancellation

TYPO3 Shop by coding.ms versions before 4.9.4, 5.0.0 through 5.21.0, and 6.0.0 through 6.2.0 contain missing authorization in cancelAction, allowing an unauthenticated visitor to cancel a prepared order by supplying its UID. https://packetstorm.news/download/236753...

Exploit for CVE-2026-112071

CVE-2026-112071: any visitor can cancel other people's orders...

CVE-2026-112071

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-112071 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

EUVD-2026-104866

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-112071 Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-112071

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-112071

The TYPO3 Shop by coding.ms extension contains a Broken Access Control vulnerability (CWE-862) in its order cancellation function. The application accepts an order identifier from a request and processes the cancellation without verifying if the requester owns the order. Consequently, any site vi...

PT-2026-118308

The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are...

CVE-2026-103231

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-103231 AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-103231

A SQL injection vulnerability exists in the Order Cancellation component of the AdithyaYelloju Restaurant-Management-System (up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c). The flaw is located in the mysqli_query function within the User/cancel.php file, where manipulation of the ID argum...

CVE-2026-103231 AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

EUVD-2026-90074

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...

CVE-2026-103231 AdithyaYelloju Restaurant-Management-System Order Cancellation cancel.php mysqli_query sql injection

A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected element is the function mysqliquery of the file User/cancel.php of the component Order Cancellation. The manipulation of the argument ID leads to sql injectio...