CVE-2026-18603

The CVE concerns the PiWeb Cancel order / Refund request plugin for WooCommerce (WordPress) prior to version 1.3.4.34. The issue is a lack of authorization/ownership checks when adding contents of a previous order to the cart, enabling unauthenticated users to disclose other customers’ order cont...