Security Alert Summary
The Cargo Shipping Location for WooCommerce plugin prior to 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses. The endpoint relies on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment-related metadata.
CVE Details
- CVE ID: CVE-2026-106025
- Affected component: Cargo Shipping Location for WooCommerce (plugin)
- Affected versions: Versions before 6.0 (example affected version listed: 4.0.0)
- Published: 9:17 AM on November 10, 2026
- Last modified: 4:28 PM on November 10, 2026
- CVSS v3.1: Base score 5.3, MEDIUM — vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Authentication / Privileges / User interaction: Privileges Required: NONE; User Interaction: NONE; Attack Vector: NETWORK; Attack Complexity: LOW
- Primary impact: Confidentiality: NONE; Integrity: LOW; Availability: NONE
- CWE / weakness ID: Not specified in the provided data
Technical Details
The vulnerability is a failure to properly restrict access to a REST API endpoint that updates order shipment statuses. Authorization for the endpoint depends on a value that can be controlled by an attacker, rather than on a verified capability check or authenticated user context. As described, this allows unauthenticated users to submit requests that update order status and shipment metadata.
The issue exists because the endpoint does not enforce appropriate access control checks. No specific function names or endpoints beyond the REST API endpoint for updating order shipment statuses are provided in the available data.
Impact is limited to modification of order shipment state and related metadata. The CVSS vector indicates no confidentiality or availability impact, and a LOW integrity impact reflecting the ability to alter order shipment information without authentication.
How This Could Impact Your Website
On a typical site, the site owner, internal staff (for example store managers or fulfillment staff), and external contractors or contributors interact with the orders and shipping workflow. If an attacker can modify order shipment statuses or shipment metadata without authentication, practical consequences include operational confusion (orders marked as shipped or delivered incorrectly), inaccurate fulfillment records, or misleading customer-facing information.
An attacker could use manipulated shipment information to send misleading communications or create plausible pretexts for social engineering or phishing against customers or staff, especially when combined with other information. This vulnerability does not indicate direct disclosure of stored private data, but the altered order state can still disrupt business processes and customer trust.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, particularly for contributors or non-administrative users.
- Enforce strong passwords and enable two-factor authentication for editor and administrator accounts.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and order logs for unusual behavior, such as unexpected status changes on orders.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
