CVE-2026-106025

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and...

EUVD-2026-120854

The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and...

CVE-2026-106025

The Cargo Shipping Location for WooCommerce WordPress plugin (versions 4.0.0 through 5.7.1) contains a vulnerability where a REST API endpoint fails to properly restrict access. Because the endpoint relies on an attacker-controllable value for authorization, unauthenticated users can manipulate o...