EUVD-2026-43119
GHSA-925v-q6j4-3pxp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
PR:L confirmed by subscriber-level requirement; I:L only as shipment option tampering has no confidentiality or availability impact; AV:N and AC:L as the AJAX endpoint is network-accessible with no special conditions.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view and modify shipment options - including carrier, delivery type, package type, number of labels, weight, signature requirement, and insurance - on any arbitrary order.
AnalysisAI
Authorization bypass in the MyParcel (woocommerce-myparcel) WordPress plugin allows any authenticated subscriber-level user to view and modify shipment options - including carrier, delivery type, package type, label count, weight, signature requirement, and insurance - on arbitrary WooCommerce orders they do not own. All plugin versions up to and including 4.25.1 are affected, with the flaw rooted in missing capability checks on administrative AJAX handlers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session at subscriber level or above - the lowest non-anonymous role, typically granted automatically upon customer account creation on WooCommerce stores. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) scores 4.3 (Medium), which accurately reflects the bounded impact: integrity-only, low severity, no confidentiality or availability consequence. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers as a customer on a WooCommerce store running the vulnerable MyParcel plugin, obtaining subscriber-level credentials. Using those credentials, the attacker sends crafted authenticated HTTP requests directly to the vulnerable AJAX handlers in class-wcmypa-admin.php, referencing arbitrary order IDs. … |
| Remediation | An upstream code fix is available via the WordPress plugin SVN changeset 3585914 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3585914%40woocommerce-myparcel&new=3585914%40woocommerce-myparcel); however, the specific released plugin version incorporating this fix is not independently confirmed from the available data - administrators should verify the current version in the WordPress plugin repository and upgrade beyond 4.25.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today