WordPress Plugin Vulnerabilities

WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF

Description

The plugin does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of their own orders via a crafted request.

Proof of Concept

Affects Plugins

Plugin icon
wc-vendors
Fixed in 2.7.2.1

References

CVE
CVE-2026-81426

Classification

Type
CSRF
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-352
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Usama Arshad
Submitter
Usama Arshad
Submitter website
https://www.usamaarshad.me/
Submitter twitter
usama0x01
Verified
Yes
WPVDB ID
804efc9d-d2b4-46f0-a84f-0ff5fed7d3d6

Timeline

Publicly Published
2026-08-31 (about 2 days ago)
Added
2026-08-31 (about 1 day ago)
Last Updated
2026-08-31 (about 1 day ago)

Other

Published
Title
Published
2025-05-07
Title
Ultimate WP Mail < 1.3.5 - Cross-Site Request Forgery
Published
2025-07-16
Title
WP Post Hide < 1.1.0 - Cross-Site Request Forgery
Published
2025-05-07
Title
WP Fundraising Donation and Crowdfunding Platform < 1.7.4 - Cross-Site Request Forgery
Published
2025-04-04
Title
404 Image Redirection (Replace Broken Images) <= 1.4 - Cross-Site Request Forgery
Published
2026-07-20
Title
Podlove Podcast Publisher < 4.5.3 - Podcast Contributor/Group/Role Creation and Deletion via CSRF