CVE-2026-118757: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees
PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the updatefees AJAX handler that allows unauthenticated attackers to modify and read other customers' orders. Attackers can reuse a nonce from their own order-pay page and supply sequential orderid values to change payment methods, recalculate fees, and disclose order line items and totals.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PiWeb Disable payment method / Partial payment for WooCommerceto a version that resolves this vulnerability.Fixed in 1.1.10.9
Event History
Frequently Asked Questions
Who is exposed to this issue?
WooCommerce sites using PiWeb Disable payment method / Partial payment for WooCommerce versions before 1.1.10.9 are affected. The vulnerable functionality is the plugin's update_fees AJAX handler.
What does an attacker need to exploit it?
No authentication or user interaction is required. An attacker needs a nonce from their own order-pay page and can provide sequential order_id values to target other customers' orders.
What can an attacker do through the vulnerable handler?
An attacker can change payment methods and recalculate fees on other customers' orders. They can also read order line items and totals.
How can I tell whether my site may be vulnerable?
Check whether the PiWeb Disable payment method / Partial payment for WooCommerce plugin is installed and running a version earlier than 1.1.10.9. Sites using those versions should treat the update_fees AJAX handler as exposed.