CVE-2026-106025
Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.
| Vendor | unknown |
| Product | cargo shipping location for woocommerce |
| Published | Nov 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown cargo shipping location for woocommerce
Be the first to know when new medium vulnerabilities affecting unknown cargo shipping location for woocommerce are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
Unknown / Cargo Shipping Location for WooCommerce
4.0.0 < 6.0
References
Credits
WPScan