CVE-2026-111659: Missing Authentication for Critical Function in wayn111 waynboot-mall

CVE-2026-111659 describes a missing authentication vulnerability in waynboot-mall through version 2.0.0. The vulnerability exists in the internal message-queue callback at /callback/order/submit, which lacks authentication controls. Attackers can invoke this endpoint without credentials, providing arbitrary userId, addressId, and cart ids in the order JSON payload. This enables them to create orders on behalf of any member, access stored shipping information, clear user carts, and reduce inventory stock levels.

The vulnerability allows unauthenticated attackers to perform unauthorized order creation, potentially causing fraudulent transactions. It also exposes sensitive shipping details of users, compromises cart integrity by clearing carts, and affects inventory accuracy by decrementing stock without legitimate orders. These impacts can lead to financial loss, privacy breaches, and operational disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /callback/order/submit endpoint to trusted internal systems only and implement additional authentication or network-level controls to prevent unauthorized access.