CVE-2026-18603

This CVE exposes a WooCommerce plugin that failed to verify order ownership before returning order contents or restoring order contents to the user's cart. The vulnerability was accessible without authentication — anyone with a valid order ID could retrieve that order's data or manipulate the cart using it. The root cause is straightforward: the plugin accepted an order ID from user input (`$_GET['order_id']`), sanitized it, but never verified that the requesting user owned that order. WooCommerce order IDs are sequential integers visible in confirmation emails, invoices, and the refund workflow — they're not secrets. An attacker can enumerate them trivially by collecting any customer's order confirmation email or observing the sequential IDs in publicly-shared invoice patterns. The fix requires a single ownership check: verify that `get_current_user_id()` matches `$order->get_user_id()` (or use `current_user_can('edit_shop_order', $order_id)` for admin-level operations). This is not a case where secure implementation required architectural work — it's a one-line authorization gate that was simply missing. For defenders auditing WooCommerce plugins: any plugin that accepts an order ID from user input and returns order data or performs cart operations is suspect until proven otherwise. The vulnerability class is authentication-checked-but-not-authorization-scoped — the plugin verified the user was logged in but never verified the user owned the specific order. Review any plugin feature that takes an `order_id` parameter and returns order contents, prices, addresses, or modifies cart state. The absence of a `get_current_user_id() === $order->get_user_id()` check (or its capability-based equivalent) is the vulnerability signature. This pattern likely exists in other WooCommerce plugins. The platform provides `wc_get_order()` but does not model ownership-scoped access as the required default pattern in its documentation or codebase — developers must independently recognize that every order-related operation requires explicit ownership verification. Treat this CVE as a beacon: if you're running plugins that handle order data and accept order IDs as parameters, audit them for this specific authorization gap.

Reviewed through automated stages and approved by a human before publication.