CVE-2026-89289

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id...

PT-2026-106337

Name of the Vulnerable Software and Affected Versions Fast Courier versions prior to 5.2.4 Description The Fast Courier WordPress plugin fails to restrict an unauthenticated REST route used for writing order fulfillment data. This allows unauthenticated attackers to overwrite the courier status a...