CVE-2026-118757 PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118757?
CVE-2026-118757 is a medium-severity vulnerability in PiWeb Disable payment method / Partial payment for WooCommerce, published on 28 Oct 2026.
Official description
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_fees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential order_id values to change payment methods, recalculate fees, and disclose order line items and totals.
Weakness: CWE-862
Which versions are affected by CVE-2026-118757?
How do I fix CVE-2026-118757?
No fix has been published for CVE-2026-118757 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118757 being exploited?
There is no known exploitation of CVE-2026-118757 in the wild and no public exploit code.
Sources
Also known as GHSA-cj89-254r-p494.