What is the CVSS score of EUVD-2026-40112?

EUVD-2026-40112 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.3%.

Colissimo WooCommerce Plugin EUVD-2026-40112

Q: Which versions of Colissimo WooCommerce Plugin are affected by EUVD-2026-40112?

Unauthenticated IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce (versions ≤ 2.9.0) exposes shipping-related backend objects to manipulation by remote, unauthenticated attackers.

| CVE-2026-57341 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-29 Patchstack

GHSA-rxh5-g3fx-mmx7

WordPress Authentication Bypass Wordpress Plugin Colissimo Officiel Colissimo

6.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

vuln.today AI

6.5 MEDIUM

Unauthenticated network exploitation (PR:N, AV:N) with impact bounded to partial shipping-record manipulation and disruption; no confidentiality breach applies.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 29, 2026 - 15:24 vuln.today

CVE Published

Jun 29, 2026 - 13:36 cve.org

MEDIUM 6.5

DescriptionCVE.org

Unauthenticated Insecure Direct Object References (IDOR) in Colissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 versions.

AnalysisAI

Unauthenticated IDOR in Colissimo Officiel : Méthodes de livraison pour WooCommerce (versions ≤ 2.9.0) exposes shipping-related backend objects to manipulation by remote, unauthenticated attackers. Missing server-side authorization on object lookups allows adversaries to reference records belonging to other users, producing low integrity and availability impacts on WooCommerce shipping data with no confidentiality breach. No public exploit code or active exploitation has been identified at time of analysis, and no patched version number was independently confirmed in the available intelligence.

Technical ContextAI

Colissimo Officiel is a WooCommerce plugin integrating Colissimo (La Poste, the French national postal service) shipping methods into WordPress e-commerce stores. CWE-639 (Authorization Through User-Controlled Key) describes the root cause: the plugin uses user-supplied parameters - likely order IDs, shipment reference numbers, or similar identifiers - to retrieve or update backend shipping objects without verifying that the requesting principal is authorized to access the referenced record. This classic IDOR pattern is amplified here by the absence of any authentication requirement (CVSS PR:N), meaning any internet-accessible request can trigger the vulnerable lookup. The CPE cpe:2.3:a:colissimo:colissimo_officiel_:_méthodes_de_livraison_pour_woocommerce:*:*:*:*:*:*:*:* confirms the vulnerable component is the plugin itself, not the WooCommerce or WordPress core.

RemediationAI

Update the Colissimo Officiel WooCommerce plugin to a version above 2.9.0 as soon as a patched release is published. No exact fixed version number was confirmed in the available intelligence - consult the Patchstack advisory directly at https://patchstack.com/database/wordpress/plugin/colissimo-shipping-methods-for-woocommerce/vulnerability/wordpress-colissimo-officiel-methodes-de-livraison-pour-woocommerce-plugin-2-9-0-insecure-direct-object-references-idor-vulnerability for the confirmed patch version before upgrading. If an immediate update is unavailable, consider deploying a WAF rule to validate that object reference parameters in plugin requests match the authenticated session's order ownership - note this may produce false positives for legitimate guest-checkout flows. Alternatively, temporarily disable the plugin to eliminate the attack surface, accepting the trade-off of losing Colissimo shipping method availability for customers. Patch status is 'patch available per vendor advisory' but the exact fixed version has not been independently confirmed in the provided data.