What is the CVSS score of CVE-2026-57760?

CVE-2026-57760 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Sendcloud Shipping CVE-2026-57760

EUVD-2026-41324 MEDIUM

Missing Authorization (CWE-862)

2026-07-02 audit@patchstack.com

GHSA-92qf-5wrq-7gjm

WordPress Authentication Bypass Wordpress Plugin

5.3

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible WordPress plugin endpoint requires no authentication (PR:N, AV:N, AC:L); impact is strictly limited to minor unauthorized integrity modification with no confidentiality or availability effects.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:39 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels.

This issue affects Sendcloud Shipping: from n/a through 1.0.29.

AnalysisAI

Missing authorization checks in the Sendcloud Shipping WordPress plugin (versions through 1.0.29) allow unauthenticated remote attackers to perform unauthorized integrity-impacting actions without credentials. Rooted in CWE-862, the plugin fails to enforce capability checks on one or more endpoints or AJAX handlers, enabling access control bypass as tagged by Patchstack. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; EPSS data was not provided, but the unauthenticated network vector (PR:N) lowers the bar for opportunistic probing.

Technical ContextAI

The Sendcloud Shipping plugin integrates WordPress and WooCommerce storefronts with the Sendcloud logistics and shipping platform. CWE-862 (Missing Authorization) indicates that one or more plugin-registered endpoints - likely WordPress AJAX actions (wp_ajax_nopriv_*) or REST API routes - execute privileged operations without invoking current_user_can() or equivalent capability checks. This is a structurally common class of WordPress plugin flaw where developer-defined hooks are registered in a way that makes them accessible to unauthenticated visitors. No CPE string was included in the available intelligence; the affected product is identified solely by plugin slug (sendcloud-connected-shipping) and version ceiling of 1.0.29.

RemediationAI

Update the Sendcloud Shipping plugin to a version above 1.0.29 via the WordPress plugin repository or admin dashboard. The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/sendcloud-connected-shipping/vulnerability/wordpress-sendcloud-shipping-plugin-1-0-28-broken-access-control-vulnerability should be consulted for the confirmed fixed version, as no explicit patched release number was included in the available data. If an immediate update is not possible, deploying a WordPress Web Application Firewall such as Patchstack MU-Plugin or Wordfence can provide virtual patching for broken access control bypass attempts, with the trade-off of added plugin overhead. Alternatively, temporarily deactivating the Sendcloud Shipping plugin eliminates the attack surface entirely at the cost of losing shipping integration functionality until the update can be applied.