CVE-2026-111660 — waynboot-mall through 2.0.0 Missing Authentication via /callback/order/unpaid
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/un…
Published: 2026-10-16 · CVSS: 6.9 · CVSS 4.0
waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7