Unauthenticated order disclosure via unchecked reorder actions

Missing authorization in PiWeb Cancel order / Refund request for WooCommerce before 1.3.4.34 allows remote attackers to read order contents. The pi_reorder, pi_reorder_replace, and pi_reorder_merge AJAX actions accept an arbitrary order_id and copy that order's products into the requester's cart without a nonce, authorization check, or ownership check. Exploitation requires repeat ordering to be enabled for an order status and a target order ID; the replace action can also clear and repopulate a logged-in user's cart through a crafted link.