CVE-2026-127207
Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions
Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760.
| CWE | CWE-862 |
| Vendor | sendcloud |
| Product | sendcloud for woocommerce: automated shipping, branded tracking & returns |
| Published | Nov 12, 2026 |
Get instant alerts for sendcloud sendcloud for woocommerce: automated shipping, branded tracking & returns
Be the first to know when new medium vulnerabilities affecting sendcloud sendcloud for woocommerce: automated shipping, branded tracking & returns are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N