Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck
CVE-2026-118757PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
Medium 6.5
In plain English
A medium-severity missing authorization in PiWeb Disable payment method / Partial payment for WooCommerce from PI Websolution. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).
Official description
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PI Websolution | PiWeb Disable payment method / Partial payment for WooCommerce | 0 – before 1.1.10.9 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
References
- https://plugins.svn.wordpress.org/disable-payment-method-for-woocommerce/tags/1.1.10.7/public/class-apply-order-fees.php technical-description
- https://plugins.trac.wordpress.org/changeset/3751777/disable-payment-method-for-woocommerce patch
- https://wordpress.org/plugins/disable-payment-method-for-woocommerce/ product
- VulnCheck Advisory: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees third-party-advisory