The PiWeb Disable payment method / Partial payment for WooCommerce plugin contains a missing authorization flaw in its AJAX handler that allows attackers to submit the update_fees request without proper checks. By reusing a nonce from their own order-payment page and iterating through order identifiers, an attacker can alter payment methods, recalibrate fees, and retrieve the contents and totals of other customers’ orders. The effect is unauthorized manipulation of monetary transactions and exposure of confidential order details, which can result in financial damage and privacy compromise.

The vulnerability applies to the PiWeb Disable payment method / Partial payment for WooCommerce plugin for WordPress versions up to and including 1.1.10.9. No other product or version information is provided.

With a CVSS score of 6.9 the flaw is classified as moderate risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers do not need credentials; they only need to send an AJAX request to the update_fees endpoint with an appropriate nonce that can be copied from their own session. The required escalation is relatively low, making the attack vector reliable for anyone with internet access to the site. The lack of diffusion of the vulnerability suggests exploitation would begin locally unless automated scripts are disseminated. Nonetheless, the potential damage warrants immediate attention.