Is CVE-2026-111659 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-111659 being exploited in the wild.

How severe is CVE-2026-111659?

Medium severity, with a CVSS score of 6.5, published 16 October 2026.

Which products and versions are affected?

Wayn111 Waynboot-Mall through 2.0.0.

Is there a fix for CVE-2026-111659?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-111659 attacked?

It is attacked over the network.

Am I affected by CVE-2026-111659?

Check whether you run Wayn111 Waynboot-Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-111659: Waynboot-mall missing authentication in order submission

CVE-2026-111659 · Severity: medium · CVSS 6.5 · Published 2026-10-16

Waynboot-mall is an e-commerce platform that manages shopping carts, orders, and customer data. An unauthenticated attacker can forge orders for any customer account by directly calling an internal callback endpoint, exposing stored shipping addresses, clearing other users' carts, and reducing product stock without authorization.

Technologies: Wayn111 Waynboot-Mall. Vendors: Wayn111.

Quick answers

Is CVE-2026-111659 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-111659 being exploited in the wild.
How severe is CVE-2026-111659?: Medium severity, with a CVSS score of 6.5, published 16 October 2026.
Which products and versions are affected?: Wayn111 Waynboot-Mall through 2.0.0.
Is there a fix for CVE-2026-111659?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-111659 attacked?: It is attacked over the network.
Am I affected by CVE-2026-111659?: Check whether you run Wayn111 Waynboot-Mall at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The /callback/order/submit endpoint in the SubmitOrderController lacks authentication checks and accepts arbitrary userId and addressId parameters in the order JSON payload. An unauthenticated network attacker can invoke this callback directly to submit orders on behalf of any user, manipulate cart data, and trigger inventory decrements. The vulnerability requires no authentication or user interaction.

Affected products

Wayn111 Waynboot-mall through 2.0.0

Timeline

2026-10-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.