CVE-2026-127207: Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions
Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the scsupportget and scsupportsave AJAX actions due to the absence of capability and nonce checks in SCCSPSupportController. Attackers can call these wpajax handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATIONID, SERVICEPOINT, CARRIERS, and MINLOGLEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760.
Event History
Frequently Asked Questions
Which users can exploit the affected AJAX actions?
Any authenticated low-privileged WordPress user, including a Subscriber, can invoke the affected actions. The attacker does not need administrative permissions.
What access and changes are possible?
An attacker can disclose integration configuration values including INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL. They can also change the plugin's logging verbosity.
Is user interaction required for exploitation?
No interaction is required when an authenticated low-privileged user directly calls the wp_ajax_ handlers. The actions can also be reached through cross-site request forgery.
How can I determine whether my site is affected?
Sites using Sendcloud for WooCommerce version 1.0.41 or earlier are affected according to the available information. The relevant AJAX actions are sc_support_get and sc_support_save in SCCSP_Support_Controller.