CVE-2026-89289
Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.
| Vendor | unknown |
| Product | fast courier |
| Published | Oct 6, 2026 |
| Last Updated | Oct 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown fast courier
Be the first to know when new medium vulnerabilities affecting unknown fast courier are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Fast Courier
0 ≤ 5.2.3
References
Credits
Enrico Marcolini - Claudio Marchesini - Dottor Marc WPScan