What is the CVSS score of CVE-2026-8678?

CVE-2026-8678 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

MyParcel WordPress Plugin CVE-2026-8678

EUVD-2026-43119 MEDIUM

Missing Authorization (CWE-862)

2026-07-11 Wordfence

GHSA-925v-q6j4-3pxp

WordPress Authentication Bypass Wordpress Plugin Myparcel

4.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

PR:L confirmed by subscriber-level requirement; I:L only as shipment option tampering has no confidentiality or availability impact; AV:N and AC:L as the AJAX endpoint is network-accessible with no special conditions.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 03:59 vuln.today

CVE Published

Jul 11, 2026 - 02:31 cve.org

MEDIUM 4.3

DescriptionCVE.org

The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view and modify shipment options - including carrier, delivery type, package type, number of labels, weight, signature requirement, and insurance - on any arbitrary order.

AnalysisAI

Authorization bypass in the MyParcel (woocommerce-myparcel) WordPress plugin allows any authenticated subscriber-level user to view and modify shipment options - including carrier, delivery type, package type, label count, weight, signature requirement, and insurance - on arbitrary WooCommerce orders they do not own. All plugin versions up to and including 4.25.1 are affected, with the flaw rooted in missing capability checks on administrative AJAX handlers. No public exploit or active exploitation has been identified at time of analysis, though the low privilege bar (any registered WordPress user) expands the realistic attacker pool significantly for e-commerce stores.

Technical ContextAI

The vulnerability resides in the WooCommerce-integrated MyParcel plugin (CPE: cpe:2.3:a:richardperdaan:myparcel:*:*:*:*:*:*:*:*), developed by richardperdaan. The affected code is concentrated in class-wcmypa-admin.php, specifically at lines 118, 653, and 872 across both the 4.24.3 and 4.25.1 tagged releases - indicating the flaw spans at least two minor release cycles. CWE-862 (Missing Authorization) describes the root cause: WordPress admin AJAX or REST-style action handlers in the plugin execute privileged operations without verifying that the calling user holds an appropriate WordPress capability (e.g., manage_woocommerce or edit_shop_orders). WordPress's capability system is opt-in - plugins must explicitly call current_user_can() or equivalent; omitting this check silently grants all authenticated users access to the handler.

RemediationAI

An upstream code fix is available via the WordPress plugin SVN changeset 3585914 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3585914%40woocommerce-myparcel&new=3585914%40woocommerce-myparcel); however, the specific released plugin version incorporating this fix is not independently confirmed from the available data - administrators should verify the current version in the WordPress plugin repository and upgrade beyond 4.25.1. As a compensating control while awaiting a confirmed patched release, store operators can restrict WordPress user registration to prevent unknown parties from obtaining subscriber accounts, thereby eliminating the unauthenticated-to-subscriber escalation path. Alternatively, a WAF rule blocking unauthorized access to the specific AJAX actions handled in class-wcmypa-admin.php (lines 118, 653, 872) can reduce exposure. These workarounds do not eliminate the flaw for stores with existing registered customers.