CVE-2026-18603: Unauthenticated Order Content Disclosure in Cancel Order & Request WooCommerce

Vulnerability Overview Vulnerability Name: Cancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions Description: The plugin fails to perform authorization or ownership checks when adding previous order contents to the cart, allowing unauthorized users to disclose other customers' order contents and to clear and repopulate the logged-in user's cart via crafted links. CVE ID: CVE-2026-18603 Classification: - Type: NO AUTHORISATION - OWASP Top 10: A5: Broken Access Control - CWE: CWE-862 - CVSS: 6.5 (medium) Affected Range Affected Plugin: cancel-order-request-woocommerce Fixed Version: 1.3.4.34 Remediation Fixed Version: Upgrade to version 1.3.4.34 or higher. Additional Information Original Researcher: Shikhali Jamalzade Submitter: Shikhali Jamalzade Submitter Website: https://alisalive.medium.com Submitter Twitter: @AlisAlive Verification Status: Yes WPVDB ID: 544a35ce-c858-4718-ab43-6e945de6f278 Timeline Public Release Date: 2026-08-03 Add Date: 2026-08-03 Last Updated Date: 2026-08-03 Other Related Vulnerabilities Quiz Maker < 6.5.2.5: Missing Authorization to Unauthenticated Quiz Data Retrieval Solace < 2.1.17: Missing Authorization School Management System - WordPress < 2.2.17: Missing Authorization to Arbitrary User Deletion User Extra Fields < 16.9: Missing Authorization weMail < 2.0.8: Missing Authorization to Unauthenticated Form Deletion POC Code POC Code: The PoC will be displayed on August 17, 2026, to give users the time to update.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18603: Unauthenticated Order Content Disclosure in Cancel Order & Request WooCommerce

More from this source