WordPress security changelog
MEDIUM CVE-2026-65501 Deferred

Shiptastic for WooCommerce: A security weakness

Shiptastic for WooCommerce is affected by a security weakness. The vulnerable path is reachable without authentication. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is n/a through 5.1.0.

CVE / CNA score 5.3 CVSS 3.1 · audit@patchstack.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
Shiptastic for WooCommerce
Plugin slug
shiptastic-for-woocommerce
Affected
n/a through 5.1.0
Safe version
5.1.1
Published
Jul 23, 2026
Weakness
CWE-639 — Authorization Bypass Through User-Controlled Key

This CVE was published Jul 23, 2026 and is one of 1 known issue for this plugin.

What to do

Patch or disable the affected component.

Update Shiptastic for WooCommerce to 5.1.1 or later, or disable and remove it until a fixed version is available.

Source record

Technical description

Unauthenticated Insecure Direct Object References (IDOR) in Shiptastic for WooCommerce <= 5.1.0 versions.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Primary and upstream sources