CVE-2026-112071
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 20, 2026
Vendor
unknown
Description
The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a page that contains the shop's order plugin. Orders that are already paid are not affected.