CVE-2026-81427: WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change
The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user with a vendor account can exploit it. The issue is limited to the plugin's front-end order shipment status change functionality.
What access or conditions are required?
The attacker must be authenticated as a vendor and submit a shipment status change for an order they do not own. No customer, administrator, or unauthenticated access requirement is stated.
What is the impact of a successful exploit?
A malicious vendor can mark another vendor's order as shipped, create an order note attributed to the victim vendor, and cause a shipment notification email to be sent to the customer.
Which versions are affected?
WC Vendors versions before 2.7.2.1 are affected. Updating to version 2.7.2.1 or later addresses the affected version range described.