Disable Payment Method CVE-2026-118757

No special configuration is required - the update_fees AJAX handler is reachable by unauthenticated users (PR:N) against default installations of PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9, and the missing authorization check lets any caller act on orders they do not own. The concrete prerequisites stated in the description are: (1) a valid nonce, which the attacker legitimately obtains from their own order-pay page, and (2) supplying sequential order_id values to target other customers' orders. Limiting factors: the attacker must first acquire a usable nonce via their own order flow, and must guess/enumerate valid order_id values (sequential IDs make this easy); only WooCommerce sites running this specific plugin below 1.1.10.9 are affected, and impact is confined to order metadata disclosure and payment-method/fee modification.

This is a genuine, moderate-priority issue rather than inflated CVSS. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L) scores 6.9 and aligns with the described mechanism: a network-reachable, unauthenticated, low-complexity broken-access-control flaw with low confidentiality and low integrity impact and no availability impact. The vuln.today Decision label is 'this_month' (not act_now/emergency), consistent with a meaningful but non-critical priority. No EPSS probability was supplied, there is no CISA KEV listing, and no proof-of-concept or exploit reference is present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The one factor that raises real-world practicality above the raw score is that the attack targets sequential/guessable order_id values and only requires a nonce the attacker can self-issue from their own order-pay page - i.e., the access control gap is simple to script. Impact is bounded (order metadata disclosure and payment-method/fee tampering, not full account or site takeover), which is why integrity and confidentiality are rated Low. Missing data to note: no EPSS, no KEV, and no independent PoC - the finding rests on a single researcher source (VulnCheck) plus the vendor patch.

An attacker places or accesses their own order to obtain a valid nonce from the order-pay page, then replays that nonce against the unauthenticated update_fees AJAX handler while iterating sequential order_id values belonging to other customers. For each guessed order they can read back line items and totals and alter the payment method and recalculated fees. No public PoC is identified, but the technique requires only standard HTTP requests and low skill.