CVE-2026-103378: Geliver Akıllı Kargo Pazaryeri 3.0.0 - 3.1.0 - Unauthenticated API Key Disclosure via Public Log File
The Geliver Akıllı Kargo Pazaryeri WordPress plugin before 3.1.1 does not prevent unauthenticated access to a log file it stores within its own web-accessible directory, into which it writes the site's carrier integration key while processing requests from unauthenticated users, allowing attackers to retrieve the key and use it to modify WooCommerce order statuses. The same log file also exposes customer information from orders the shop has processed.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
WordPress sites using Geliver Akıllı Kargo Pazaryeri versions before 3.1.1 are affected when the plugin's log file remains web-accessible.
Does exploitation require an account or other prior access?
No. An unauthenticated attacker can access the exposed log file and obtain the carrier integration key.
What can an attacker do with the disclosed information?
The carrier integration key can be used to modify WooCommerce order statuses. The log file may also disclose customer information from processed orders.
How can I determine whether my site needs remediation?
Check the installed plugin version. Versions earlier than 3.1.1 should be treated as affected.