CVE-2026-111659 Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit
Unauthenticated attackers can forge orders and expose user data by accessing an unprotected callback endpoint in Waynboot-mall.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111659?
CVE-2026-111659 is a medium-severity missing authorization vulnerability in wayn111 waynboot-mall, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
Weakness: CWE-306
Which versions are affected by CVE-2026-111659?
How do I fix CVE-2026-111659?
No fix has been published for CVE-2026-111659 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111659 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111659 exists.
Sources
Also known as GHSA-gvqp-2ghw-m8w7.