19 matches found
CVE-2026-93580
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parcel tracking number to forge its shipme...
CVE-2026-81426
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81427
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
CVE-2026-81426
The WC Vendors WordPress plugin, in versions prior to 2.7.2.1 , is vulnerable to a Cross-Site Request Forgery (CSRF) attack. The root cause is a lack of CSRF protection on specific front-end order shipment status actions. This flaw could allow an attacker to force a logged-in vendor to modify the...
CVE-2026-81426 WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
EUVD-2026-69854
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
EUVD-2026-69853
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
WordPress WC Vendors plugin < 2.7.2.1 - Order Shipment Status Change vulnerability
Order Shipment Status Change vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
WordPress WC Vendors plugin < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change vulnerability
Vendor+ Cross-Vendor Order Shipment Status Change vulnerability discovered by Bhaveshkumar Parmar in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
CVE-2026-81427
The WC Vendors WordPress plugin (versions before 2.7.2.1 ) contains a Missing Authorization vulnerability. The plugin fails to verify that a vendor owns the referenced order when submitting a shipment status change from the front-end. This allows any authenticated vendor to modify another vendor'...
CVE-2026-81427: Missing Authorization
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
CVE-2026-81426: Cross-Site Request Forgery (CSRF)
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
PT-2026-84633
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
PT-2026-84634
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
Threat Outbreak Alert RuleID23127: Email Messages Distributing Malicious Software on May 26, 2016
Medium Alert ID: 46420 First Published: 2016 May 26 21:00 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID23127 may contain the following files: Name | Size...
Threat Outbreak Alert RuleID22938: Email Messages Distributing Malicious Software on May 18, 2016
Medium Alert ID: 46266 First Published: 2016 May 18 15:51 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID22938 may contain the following files: Name | Size...
Threat Outbreak Alert RuleID20538: Email Messages Distributing Malicious Software on January 19, 2016
Medium Alert ID: 43079 First Published: 2016 January 19 15:16 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID20538 may contain the following files: Name |...