WordPress Plugin Vulnerabilities

Colissimo shipping methods for WooCommerce < 3.0.0 - Authenticated (Customer+) Insecure Direct Object Reference

Description

The Colissimo shipping methods for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.10.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with customer-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
colissimo-shipping-methods-for-woocommerce
Fixed in 3.0.0

References

CVE
CVE-2026-66692
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9a6921b3-a0a1-4392-ba8d-d3fb6892c639

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
TurboNexic
Verified
No
WPVDB ID
d9734459-c690-47f9-940e-ef881abddfc1

Timeline

Publicly Published
2026-07-29 (about 2 months ago)
Added
2026-08-04 (about 2 months ago)
Last Updated
2026-08-04 (about 2 months ago)

Other

Published
Title
Published
2026-07-31
Title
WooCommerce PayPal Payments < 3.4.0 - Unauthenticated Order Key and Customer PII Disclosure via IDOR
Published
2024-07-09
Title
ProfileGrid < 5.9.0 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-07-11
Title
Houzez <= 4.2.5 - Subscriber+ Insecure Direct Object Reference
Published
2024-10-16
Title
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors < 4.7.2 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary User Email Update and Account Takeover
Published
2026-09-21
Title
Booking Manager < 2.1.21 - Subscriber+ Arbitrary User Plugin Meta Modification via IDOR