CVE-2026-81790: WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability

Q: Which installations are affected?

The affected software is the WordPress plugin Csomagpontok és szállítási címkék WooCommerce-hez. Versions before 4.2.8 are affected; the earliest affected version is not specified.

Q: Does exploitation require an authenticated WordPress user or user interaction?

No. The supplied vector specifies PR:N and UI:N, indicating that exploitation requires no privileges and no user interaction. It is network-accessible (AV:N) and has low attack complexity (AC:L).

Q: What is the likely security impact?

The provided scoring vector indicates integrity impact only (I:H), with no stated confidentiality or availability impact. The issue is described as missing authorization caused by incorrectly configured access-control security levels.

Published Sep 8, 2026

Updated

Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Csomagpontok és szállítási címkék WooCommerce-hez: from n/a before 4.2.8.

Affected Software

1 affected component

WordPress Csomagpontok és szállítási címkék WooCommerce-hez<4.2.8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin to a version that resolves this vulnerability.
Fixed in 4.2.8
Compensating control
Add compensating access control by restricting public access to the vulnerable functionality/endpoint of the WooCommerce plugin until upgraded (e.g., limit access so only authenticated/authorized users can reach the affected request paths).

Event History

Sep 8, 2026

CVE Published

via MITRE·07:20 AM

Data Sourced

via MITRE·07:20 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Which installations are affected?

The affected software is the WordPress plugin Csomagpontok és szállítási címkék WooCommerce-hez. Versions before 4.2.8 are affected; the earliest affected version is not specified.

Does exploitation require an authenticated WordPress user or user interaction?

No. The supplied vector specifies PR:N and UI:N, indicating that exploitation requires no privileges and no user interaction. It is network-accessible (AV:N) and has low attack complexity (AC:L).

What is the likely security impact?

The provided scoring vector indicates integrity impact only (I:H), with no stated confidentiality or availability impact. The issue is described as missing authorization caused by incorrectly configured access-control security levels.

CVE-2026-81790: WordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress user or user interaction?

What is the likely security impact?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

Does exploitation require an authenticated WordPress user or user interaction?

What is the likely security impact?