CVE-2026-18603 is a missing authorization vulnerability (CWE-862) in the PiWeb Cancel order / Refund request for WooCommerce plugin for WordPress. Versions prior to 1.3.4.34 do not verify user authorization or ownership when adding the contents of a previous order to the shopping cart. This allows unauthenticated attackers to disclose the contents of other customers' orders and to clear and repopulate the cart of logged-in users through specially crafted URLs. The vulnerability is remotely exploitable without privileges or user interaction and impacts confidentiality and integrity but not availability.

An attacker can disclose sensitive information about other customers' orders without authentication, violating confidentiality. Additionally, the attacker can manipulate the shopping cart of logged-in users by clearing and repopulating it, impacting data integrity. There is no impact on system availability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, users should monitor vendor communications for updates and consider restricting access or implementing additional authorization checks if possible.