7 matches found
EUVD-2026-69854
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
CVE-2026-81427 WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
WordPress WC Vendors plugin < 2.7.2.1 - Order Shipment Status Change vulnerability
Order Shipment Status Change vulnerability discovered by Usama Arshad in WordPress Plugin WC Vendors Marketplace versions 2.7.2.1...
EUVD-2026-69853
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81426: Cross-Site Request Forgery (CSRF)
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...
CVE-2026-81427: Missing Authorization
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and...
PT-2026-84633
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request...