CVE-2026-81426
WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.
| Vendor | unknown |
| Product | wc vendors |
| Published | Sep 2, 2026 |
| Last Updated | Sep 2, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown wc vendors
Be the first to know when new medium vulnerabilities affecting unknown wc vendors are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WC Vendors
0 < 2.7.2.1
References
Credits
Usama Arshad WPScan