Medium severity5.3NVD Advisory· Published Nov 10, 2026
CVE-2026-106025
CVE-2026-106025
Description
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <6.0
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.