CVEvulnerability

CVE-2026-81427

4.3 MEDIUM Published 2026-09-02 Modified 2026-09-03 Official page ↗
Status
Deferred
Published
2026-09-02
Last modified
2026-09-03
Assigner
[email protected]
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
4.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-862

Description

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.

Related

Weakness · CWE (1)

  • CWE-862 Missing Authorization weakness

References