CVE-2026-81426

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

CVE-2026-81427

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2026-81427

CVE-2026-81427 affects the WC Vendors WordPress plugin (WooCommerce marketplace) in versions before 2.7.2.1 . The root cause is a missing ownership verification on the front-end order shipment status change endpoint: any authenticated vendor can target another vendor's order, mark it as shipped ,...

WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change vulnerability

Vendor+ Cross-Vendor Order Shipment Status Change vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

EUVD-2026-69853

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...

EUVD-2026-69854

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...

CVE-2026-81426

The WC Vendors WordPress plugin (versions before 2.7.2.1 ) is missing CSRF protection on some front-end order shipment status actions. An attacker can craft a request that causes a logged-in vendor to unknowingly change the shipment status of their own orders, resulting in a low integrity impact ...

WordPress WC Vendors plugin < 2.7.2.1 - Order Shipment Status Change vulnerability

Order Shipment Status Change vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...

Threat Outbreak Alert RuleID23127: Email Messages Distributing Malicious Software on May 26, 2016

Medium Alert ID: 46420 First Published: 2016 May 26 21:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23127 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID22938: Email Messages Distributing Malicious Software on May 18, 2016

Medium Alert ID: 46266 First Published: 2016 May 18 15:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22938 may contain the following files: Name | Size...

Threat Outbreak Alert RuleID20538: Email Messages Distributing Malicious Software on January 19, 2016

Medium Alert ID: 43079 First Published: 2016 January 19 15:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20538 may contain the following files: Name |...