What is the CVSS score of EUVD-2026-37640?

EUVD-2026-37640 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H. EPSS exploitation probability: 0.3%.

Which versions of Melhor Envio are affected by EUVD-2026-37640?

The Melhor Envio WordPress plugin (versions 2.16.3 and earlier) contains an authentication bypass vulnerability affecting e-commerce sites that depend on integrated shipping services; no public…

How to fix or mitigate EUVD-2026-37640?

24 hours: Identify all WordPress instances running Melhor Envio plugin ≤2.16.3 and document current version deployments. 7 days: Restrict plugin endpoint access via web application firewall rules or .htaccess to authorized administrators only; enable enhanced logging on shipping endpoints. 30 days: Monitor Melhor Envio/Patchstack security advisories for patch release; prepare deployment plan for version upgrade once available.

Melhor Envio EUVD-2026-37640

| CVE-2026-54804 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-17 Patchstack

WordPress Information Disclosure Wordpress Plugin Melhor Envio

7.6

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

vuln.today AI

7.6 HIGH

Reachable over the web by any authenticated subscriber (AV:N/AC:L/PR:L/UI:N); broken auth on a shipping action yields partial data exposure and high availability impact on fulfillment.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 11:52 vuln.today

DescriptionCVE.org

Subscriber Broken Authentication in Melhor Envio <= 2.16.3 versions.

AnalysisAI

Authentication bypass in the Melhor Envio WordPress plugin (versions 2.16.3 and earlier) allows low-privileged subscriber accounts to perform actions they should not be authorized for. With CVSS 7.6 (high) and a CWE-288 classification, the flaw lets any registered WordPress user escalate access against the plugin's restricted endpoints, with no public exploit identified at time of analysis. The Patchstack-reported issue primarily threatens shipping/quotation workflows on WordPress e-commerce sites that integrate the Brazilian Melhor Envio shipping service.

Technical ContextAI

Melhor Envio (melhor-envio-cotacao) is a popular WordPress plugin used by Brazilian WooCommerce stores to calculate shipping quotes and manage labels via the Melhor Envio shipping aggregation platform. CWE-288 (Authentication Bypass Using an Alternate Path or Channel) indicates that one or more plugin endpoints fail to properly enforce capability or role checks - typically a WordPress AJAX/REST action that verifies a nonce or login state but not the user's actual privilege level. The CPE cpe:2.3:a:melhorenvio:melhor_envio:* confirms all versions through 2.16.3 of the plugin are in scope, regardless of WordPress core or WooCommerce version.

RemediationAI

Upgrade the Melhor Envio plugin to a version newer than 2.16.3 once the vendor publishes a fixed release (patch availability per Patchstack advisory; released patched version not independently confirmed from the supplied data - verify against the Patchstack URL above before deployment). As compensating controls, disable open user registration in WordPress (Settings → General → 'Anyone can register') to prevent attackers from trivially obtaining subscriber accounts, audit existing subscriber-level accounts for unexpected activity, and restrict access to the plugin's AJAX/REST endpoints (admin-ajax.php actions and /wp-json/ routes containing 'melhor' or 'envio') via a WAF rule or Patchstack/Wordfence virtual patch until the upgrade is applied; note that disabling registration will block legitimate customer self-service signup on storefronts that rely on it. If the plugin is not actively used, deactivate and remove it entirely.