Skip to main content

Fast Courier EUVDEUVD-2026-92967

| CVE-2026-89289 MEDIUM
Missing Authorization (CWE-862)
2026-10-06 WPScan GHSA-r2m9-vxc3-w8ph
WordPress Authentication Bypass Woocommerce Unknown Fast Courier
5.3
CVSS 3.1 · Vendor: WPScan
Share

Severity by source

Vendor (WPScan) PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vuln.today AI
5.3 MEDIUM

Unauthenticated REST route reachable over the network (AV:N/PR:N/AC:L/UI:N); only order tracking fields are modifiable, so I:L with C:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None

Lifecycle Timeline

5
Metadata Corrected
Oct 06, 2026 - 13:40 vuln.today
tag: Woocommerce added
Analysis Generated
Oct 06, 2026 - 13:37 vuln.today
CVSS changed
Oct 06, 2026 - 11:22 NVD
5.3 (MEDIUM)
CVE Published
Oct 06, 2026 - 06:00 cve.org
MEDIUM 5.3
CVE Published
Oct 06, 2026 - 06:00 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

AnalysisAI

Order tampering in the Fast Courier WordPress plugin (versions through 5.2.3) lets unauthenticated attackers overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying the target order's ID to an unprotected REST route. The underlying defect is a missing authorization check (CWE-862) on the plugin's order-fulfillment endpoint, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3); the practical prerequisite is knowing or enumerating a valid WooCommerce order ID. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitable only against WordPress sites running the Fast Courier plugin (version ≤5.2.3) with WooCommerce active, via the plugin's unauthenticated order-fulfillment REST route - no login, credentials, or user interaction required (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Signals are consistent and point to a genuine but moderate-severity access-control flaw rather than a critical emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation No vendor-released patch has been identified at time of analysis, and the EUVD data lists all versions through 5.2.3 as affected, so there is currently no fixed version to upgrade to; administrators should monitor the WPScan advisory (https://wpscan.com/vulnerability/716b6d58-a816-43f2-8a1a-b9fe4f2f9d1d/) and the plugin's WordPress.org page for a patched release. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Woocommerce

View all
CVE-2017-17058 HIGH POC
7.5 Nov 29

The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/wooco
CVE-2021-24212 CRITICAL POC
9.8 Apr 05

The WooCommerce Help Scout WordPress plugin before 2.9.1 (https://woocommerce.com/products/woocommerce-help-scout/) allo
CVE-2022-50972 CRITICAL POC
9.3 Jun 20

WooCommerce 7.1.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary PHP code by

CVE-2020-35627 HIGH POC
8.8 Dec 28

Ultimate WooCommerce Gift Cards 3.0.2 is affected by a file upload vulnerability in the Custom GiftCard Template that ca
CVE-2026-14962 HIGH POC
8.6 Sep 09

Unauthenticated SQL injection in the ELEX WooCommerce Request a Quote WordPress plugin (all versions before 2.4.1) allow
CVE-2026-92404 HIGH POC
7.5 Sep 19

Unauthenticated, network-reachable attackers can read the WooCommerce API consumer key and secret stored by the MgoSync

CVE-2023-34000 HIGH POC
7.5 Jun 14

Unauth. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low atta
CVE-2020-11497 HIGH POC
7.5 Aug 26

An issue was discovered in the NAB Transact extension 2.1.0 for the WooCommerce plugin for WordPress. Rated high severit
CVE-2026-74925 HIGH POC
7.2 Sep 11

Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant admi
CVE-2023-47777 MEDIUM POC
6.5 Nov 30

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WooComm
CVE-2026-103378 MEDIUM POC
6.5 Oct 07

Unauthenticated information disclosure in the Geliver Akıllı Kargo Pazaryeri WordPress plugin (versions 3.0.0 through 3.
CVE-2026-93509 MEDIUM POC
6.5 Oct 08

Authenticated attackers with only Subscriber-level access can mint wallet funds for themselves or drain a specific victi

Same weakness CWE-862 – Missing Authorization

View all
CVE-2023-52163 HIGH POC
8.8
CVE-2025-6205 CRITICAL POC
9.1
CVE-2025-20362 HIGH POC
8.6
CVE-2017-9232 CRITICAL POC
9.8
CVE-2023-6875 CRITICAL POC
9.8
CVE-2024-4898 CRITICAL POC
9.8
CVE-2023-32117 CRITICAL POC
9.8
CVE-2020-36719 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Share

EUVD-2026-92967 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy