CVE-2026-111660 waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
Unauthenticated attackers can cancel any user's pending orders and manipulate stock levels by exploiting a missing authentication check on the order callback endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-111660?
CVE-2026-111660 is a medium-severity missing authorization vulnerability in wayn111 waynboot-mall, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
Weakness: CWE-306
Which versions are affected by CVE-2026-111660?
How do I fix CVE-2026-111660?
No fix has been published for CVE-2026-111660 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-111660 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111660 exists.
Sources
Also known as GHSA-3crc-5c36-jfx7.