Is CVE-2026-111659 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111659?

CVE-2026-111659 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111659

Description

Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling the internal /callback/order/submit message-queue callback. Attackers can supply arbitrary userId, addressId and cart ids in the order JSON to create orders for any member, expose stored shipping details, clear carts, and decrement stock.