What is GHSA-39g4-r8qh-2jjf?

GHSA-39g4-r8qh-2jjf is a security advisory published by GitHub Security Advisories with Medium severity. The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not...

Which CVE IDs does GHSA-39g4-r8qh-2jjf cover?

GHSA-39g4-r8qh-2jjf covers the following CVE IDs: CVE-2026-18603. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-39g4-r8qh-2jjf?

GHSA-39g4-r8qh-2jjf has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

GHSA-39g4-r8qh-2jjfMediumCVSS 6.5

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not...

Vendor

GitHub Security Advisories

Published

August 9, 2026

Last Modified

August 10, 2026

🔗 CVE IDs covered (1)

CVE-2026-18603 →

📋 Description

The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clear and repopulate a logged in user's cart via a crafted link.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18603
https://wpscan.com/vulnerability/544a35ce-c858-4718-ab43-6e945de6f278
https://github.com/advisories/GHSA-39g4-r8qh-2jjf