CVE-2026-81426: WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF
The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.
Affected Software
Event History
Frequently Asked Questions
Who can be affected by this issue?
Logged-in vendor accounts using affected versions of the WC Vendors WordPress plugin can be targeted. The impact is limited to changing shipment status for orders belonging to the targeted vendor.
What must an attacker do to exploit it?
An attacker must cause a logged-in vendor to submit a crafted request to one of the affected front-end order shipment status actions. The provided information does not indicate that the attacker needs an account.
Which versions should be remediated?
WC Vendors versions earlier than 2.7.2.1 are affected. Updating to version 2.7.2.1 or later addresses the missing CSRF protection described.