The vulnerability lies in the /callback/order/unpaid endpoint of waynboot-mall 2.0.0, where a missing authentication check allows any attacker to cancel any pending order. By generating predictable orderSn values built from epoch seconds and a sequential counter, the attacker can not only void orders but also manipulate product stock levels, thereby compromising the integrity of order and inventory data.

This issue affects the waynboot-mall application version 2.0.0, as released by the vendor wayn111. No other product versions are listed as vulnerable in the current CNA data.

The CVSS base score of 6.9 indicates a moderate severity. Because the endpoint accepts requests without any authentication, the attack vector is a straightforward HTTP request to /callback/order/unpaid. An attacker must simply craft the orderSn parameter; no privileged credentials or additional exploits are required. The EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, so while the exploitation probability is unknown, the lack of mitigation measures makes the risk significant. The potential business impact includes accidental or malicious order cancellation and inventory misrepresentation, which can lead to financial loss and customer dissatisfaction.