Csomagpontok WooCommerce Plugin CVE-2026-81790

No special network-level conditions are required - any internet-accessible WordPress site running the affected plugin version (before 4.2.8) with WooCommerce active is vulnerable. The exposed functionality is specific to the plugin's shipping and pickup-point management endpoints; sites that have the plugin installed but WooCommerce deactivated may not expose the vulnerable paths. Exploitation requires no authentication, no user interaction, and no non-default configuration per the AV:N/AC:L/PR:N/UI:N CVSS vector. The primary limiting factor is geographic/market scope: the plugin targets Hungarian e-commerce, narrowing the realistic attack surface to Hungarian WooCommerce stores.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N scores 7.5 and indicates network-accessible, low-complexity, unauthenticated exploitation with high integrity impact and no confidentiality or availability effect. In practice this means any internet-facing WooCommerce store running the affected plugin version is reachable without credentials. EPSS data is not present in the input, and the vulnerability is not in CISA KEV nor has a public exploit been identified. The integrity-only impact profile (I:H, C:N, A:N) implies attackers can modify shipping configurations, generate unauthorized shipping labels, or alter order-handling data, but cannot read sensitive user data or crash the service. Real-world risk is moderated by the niche geographic footprint of the plugin - it primarily serves Hungarian e-commerce operators - meaning mass automated exploitation is unlikely given the smaller target pool. The 'Authentication Bypass' tag in the input is a loose fit: the vulnerability is missing authorization (CWE-862), not an authentication bypass (which would be CWE-287/306); defenders should not conflate the two. No SSVC signals beyond the CVSS vector are available.

An unauthenticated attacker sends a crafted HTTP POST request to the plugin's unprotected AJAX or REST API endpoint on a target WooCommerce site. Because no authorization check is performed, the request is processed as if it came from a privileged user, allowing the attacker to modify shipping configurations, generate shipping labels for arbitrary orders, or alter parcel-locker assignments. No public proof-of-concept has been identified, but the straightforward nature of the flaw (missing a capability check) makes independent discovery trivial.