CVE-2026-111659: Waynboot-mall through 2.0.0 Unauthenticated Order Forgery via /callback/order/submit
Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker can exploit it remotely without authentication or user interaction by calling the internal /callback/order/submit callback and supplying crafted order JSON.
Who can be affected by forged orders?
The attacker can provide arbitrary userId, addressId, and cart identifiers, allowing orders to be created for any member rather than only an account controlled by the attacker.
What operational impact should be investigated?
Successful exploitation can expose stored shipping details, clear affected users' carts, and decrement inventory stock in addition to creating unauthorized orders.
How can defenders look for possible exploitation?
Review requests to /callback/order/submit for unauthenticated access and inspect submitted order JSON for unexpected combinations of userId, addressId, and cart IDs. Investigate unexplained orders, cart clearing, shipping-detail exposure, and stock reductions.