CVE-2026-106027

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed...

EUVD-2026-124269

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed...

PT-2026-145699

The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the authenticity of the request, on one of its payment callbacks, allowing unauthenticated users to mark arbitrary WooCommerce orders as completed...

CVE-2025-67261

CVE-2025-67261 - Content-based blind SQL injection on Abacre Retail Point of Sale 14.0.0.396 Abacre Retail Point of Sale 14.0.0.396 is vulnerable to content-based blind SQL injection. The vulnerability exists in the Search function of the Orders page. The "Search" function under the "Orders" page...

CVE-2026-102803

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon maxuses / maxcustomeruses = 1, on more than one order. By starting several checkout...

CVE-2026-102803

The Joomla extension J2Store versions 6.0.0 through 6.6.5 is vulnerable to a Time-of-check Time-of-use (TOCTOU) race condition. A logged-in customer can redeem a single gift voucher or a single-use coupon (where max_uses or max_customer_uses is 1) for multiple orders. This occurs because the syst...

CVE-2026-102803 Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon maxuses / maxcustomeruses = 1, on more than one order. By starting several checkout...

EUVD-2026-121312

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon maxuses / maxcustomeruses = 1, on more than one order. By starting several checkout...

CVE-2026-102803: j2commerce.com J2Store extension for Joomla: Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store…

Joomla Extension - j2commerce.com - Gift voucher and single-use coupon could pay for more than one order in J2Store 6.0.0 - 6.6.5 - A logged-in customer could redeem a single gift voucher, or a single-use coupon maxuses / maxcustomeruses = 1, on more than one order. By starting several checkout...

PT-2026-139905

The Thanh Toán Quét Mã QR Code Tự Động WordPress plugin through 2.0.1 does not properly verify the authenticity of incoming bank-transfer payment notifications on a default installation, allowing unauthenticated attackers to mark arbitrary WooCommerce orders as paid...

WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin < 8.11 - Subscriber+ Payment Retry on Other Users' Orders vulnerability

Subscriber+ Payment Retry on Other Users' Orders vulnerability discovered by ilqar rahimli in WordPress Plugin Directorist versions 8.11...

CVE-2026-121633

The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a...

EUVD-2026-117973

The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a...

CVE-2026-112285

A flaw was found in Thelia. A remote authenticated customer can bypass coupon usage limits to obtain unauthorized discounts. This issue occurs because promotional coupon usage is only recorded when an order is marked as paid rather than when it is placed. Consequently, an attacker can submit...

CVE-2026-114233

Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions ORDERMGRVIEW, without ORDERMGRUPDATE or any role on the order, to modify approved orders, changing a ship group's shipping...

EUVD-2026-117523

Missing check for ORDERMGRUPDATE in ordermgr allows user with only ORDERMGRVIEW permission to update orders. Affected versions before : 24.09.08 Users are recommended to upgrade to version 24.09.08 which fixes this issue...

EUVD-2026-117517

Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an authenticated user who holds only order view permissions ORDERMGRVIEW, without ORDERMGRUPDATE or any role on the order, to modify approved orders, changing a ship group's shipping...

CVE-2026-107773 Dokan < 5.3.3 - Unauthenticated Order PII Disclosure and Note Manipulation via Orders REST Endpoint

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly verify authorization when serving a single order and its order notes, allowing unauthenticated attackers to read customer and order information and to add or delete order notes for ...

CVE-2026-107773

The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin (versions before 5.3.3 ) contains a vulnerability where it fails to correctly verify authorization when serving a single order and its associated notes via the Orders REST Endpoint . This flaw allows unauthenticat...

CVE-2026-121993 wePOS before 2.0.3 Missing Authorization via payment/process Endpoint

wePOS Point Of Sale for WooCommerce before 2.0.3 contains a missing authorization vulnerability in the wepos/v1/payment/process REST route that allows authenticated vendor-level users to mark arbitrary orders as paid and completed by supplying another order's ID. Attackers with only the...