Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2026-81427: WC Vendors plugin lets any vendor fake shipment
CVE-2026-81427 · published 2 months ago
Summary
The WC Vendors extension for WordPress (versions before 2.7.2.1) does not check that a vendor changing an order's shipping status actually owns that order. As a result, a logged‑in vendor could mark another vendor's order as shipped, add false notes, and cause the customer to receive a shipment email. Update the plugin to version 2.7.2.1 or later, or restrict vendor access until the fix is applied.
What to do
- Update unknown wc vendors to version 2.7.2.1 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | wc vendors | < 2.7.2.1 |
Original advisory text
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to m...
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
4.3
Medium
Type
CWE-862Missing Authorization
Timeline
Published2 Sep 2026
Updated3 Nov 2026
First seen2 Sep 2026
Track software like this
Free during beta