Fast Courier
Monthly
Order tampering in the Fast Courier WordPress plugin (versions through 5.2.3) lets unauthenticated attackers overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying the target order's ID to an unprotected REST route. The underlying defect is a missing authorization check (CWE-862) on the plugin's order-fulfillment endpoint, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3); the practical prerequisite is knowing or enumerating a valid WooCommerce order ID. Publicly available exploit code exists, as documented in the WPScan advisory, but there is no confirmed active exploitation according to available intelligence (no CISA KEV entry; SSVC exploitation: none), and impact is limited to the integrity of courier and tracking fields with no data disclosure, code execution, or availability loss.
Order tampering in the Fast Courier WordPress plugin (versions through 5.2.3) lets unauthenticated attackers overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying the target order's ID to an unprotected REST route. The underlying defect is a missing authorization check (CWE-862) on the plugin's order-fulfillment endpoint, so remote attackers need no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3); the practical prerequisite is knowing or enumerating a valid WooCommerce order ID. Publicly available exploit code exists, as documented in the WPScan advisory, but there is no confirmed active exploitation according to available intelligence (no CISA KEV entry; SSVC exploitation: none), and impact is limited to the integrity of courier and tracking fields with no data disclosure, code execution, or availability loss.