Piweb Disable Payment Method Partial Payment For Woocommerce
Monthly
Missing authorization in the update_fees AJAX handler of the PiWeb Disable payment method / Partial payment for WooCommerce plugin (all versions before 1.1.10.9) lets unauthenticated attackers read and modify other customers' WooCommerce orders. By taking a nonce from their own order-pay page and iterating sequential order_id values, an attacker can swap payment methods, trigger fee recalculation, and disclose order line items and totals for orders they do not own, with a worst-case impact of low confidentiality and low integrity loss (CVSS 4.0 6.9; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor fix is version 1.1.10.9 and this is prioritised for remediation this month.
Missing authorization in the update_fees AJAX handler of the PiWeb Disable payment method / Partial payment for WooCommerce plugin (all versions before 1.1.10.9) lets unauthenticated attackers read and modify other customers' WooCommerce orders. By taking a nonce from their own order-pay page and iterating sequential order_id values, an attacker can swap payment methods, trigger fee recalculation, and disclose order line items and totals for orders they do not own, with a worst-case impact of low confidentiality and low integrity loss (CVSS 4.0 6.9; independently assessed as CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor fix is version 1.1.10.9 and this is prioritised for remediation this month.