WC Vendors permits cross-vendor shipment-status manipulation
WC Vendors before 2.7.2.1 does not verify that a vendor owns the order referenced by a front-end shipment-status request. Any authenticated vendor can mark another vendor's order as shipped, add a note falsely attributed to that vendor, and trigger a customer shipment email.
- Component
- WC Vendors
- Plugin slug
wc-vendors- Affected
- < 2.7.2.1
- Safe version
2.7.2.1- Published
- Sep 02, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 02, 2026 and is one of 8 known issues for this plugin.
Update, patch or deactivate.
Update to WC Vendors 2.7.2.1 or later and reconcile shipment states, order notes, and notification activity across vendor accounts.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N