Is CVE-2026-111660 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111660?

CVE-2026-111660 has a CVSS v3 severity of MEDIUM (6.5).

Back

CVE-2026-111660

Description

waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pending order via the /callback/order/unpaid endpoint. Attackers can submit predictable orderSn values, built from epoch seconds and a sequential counter, to auto-cancel unpaid orders and manipulate product stock levels.