The PiWeb Cancel order / Refund request for WooCommerce plugin allows an attacker to add the items from a previous order to a shopping cart without performing any ownership or authorization checks. Because the endpoint can be accessed by an unauthenticated user, the attacker can disclose the contents of other customers’ orders. Additionally, the same endpoint can clear a logged‑in user’s cart and repopulate it with fabricated data, which may result in a form of denial of service or improper data manipulation. The core weakness is lack of proper access control, corresponding to information‑disclosure and authorization flaws.

All installations of the PiWeb Cancel order / Refund request for WooCommerce plugin running a version earlier than 1.3.4.34 are affected, regardless of the WooCommerce version. The vulnerability is present in the AJAX actions that process order re‑add operations.

The vulnerability does not require authentication and can be triggered by a crafted request to the order-reorder endpoint. No EPSS score is currently available, and the issue is not listed in the CISA KEV catalog. The lack of authorization checks makes the attack straightforward. Based on the description, it is inferred that an attacker could obtain or guess order identifiers to access other customers’ orders, potentially exposing sensitive customer information.