CVE-2026-67359: Authorization Bypass Through User-Controlled Key

Joomla Extension - j2commerce.com - Order content disclosure J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An unauthenticated visitor could supply any orderid as a query parameter to render the full checkout confirmation page for that order, including line items, prices, and totals...

WordPress Cancel Order & Request Woocommerce plugin < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability

Unauthenticated Order Content Disclosure via Reorder AJAX Actions vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Cancel order request WooCommerce versions 1.3.4.34...

CVE-2026-18603

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin (versions before 1.3.4.34 ) is vulnerable to unauthenticated order content disclosure . The root cause is a lack of authorization or ownership checks when adding contents of a previous order to the cart via Reorder AJAX Acti...