CVE-2026-106025: Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cargo Shipping Location for WooCommerceto a version that resolves this vulnerability.Fixed in 6.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated remote users can exploit the exposed REST API endpoint. No prior account or privileges are required.
What must an attacker be able to do to manipulate an order?
The attacker must be able to send requests to the vulnerable REST API endpoint and supply an attacker-controllable value used by the plugin for authorization. Successful exploitation can alter order shipment statuses and shipment metadata.
Which plugin versions are affected?
Versions before 6.0 are affected. The reported vulnerable version range includes 4.0.0 through 5.7.1.
Is there public exploit evidence?
The vulnerability record is flagged as having a proof of concept available.