The vulnerability lies in the order cancellation function of the TYPO3 Shop by coding.ms extension. It accepts an order identifier from the incoming request and cancels the order without validating that the caller owns that order. Any user with access to a page that contains the shop's order plugin can therefore cancel orders that are still awaiting payment. This broken access control (CWE‑862) allows an unauthenticated attacker to modify the state of customer orders, resulting in financial loss or denial of service to legitimate buyers.

This flaw affects any TYPO3 installation that has the TYPO3 Shop by coding.ms extension deployed and that exposes the order cancellation page. The vendor and product impacted are the TYPO3 CMS and the “TYPO3 Shop by coding.ms” extension. No specific version range is listed in the advisory, so any deployment of the extension that is still at a pre‑patched version is potentially affected.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % shows that the likelihood of exploitation is currently very low. The vulnerability has not been recorded in the CISA KEV catalog, meaning no known active exploits exist at this time. Exploitation would proceed by sending a crafted HTTP request containing an order identifier to the plugin’s cancellation endpoint. Because no authentication or ownership check is performed, the attacker can cancel any pending order, causing revenue loss or operational disruption.