Wc Vendors
Monthly
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. A publicly available proof-of-concept exploit exists; the issue is not currently listed in CISA KEV.
Missing order-ownership verification in WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated vendor to manipulate shipment records belonging to other vendors. An attacker with a valid vendor account can submit a front-end shipment status update referencing any order ID regardless of ownership, causing the order to be falsely marked as shipped, an order note to be injected under the victim vendor's identity, and the customer to receive a fraudulent dispatch notification. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV.
CSRF protection is absent on front-end order shipment status actions in the WC Vendors WordPress plugin before version 2.7.2.1, allowing network-based attackers to manipulate a logged-in vendor's order shipment state by inducing them to visit a crafted page. The vulnerability requires no attacker authentication and no special deployment configuration beyond active vendor use of the plugin's front-end dashboard. A publicly available exploit exists via WPScan, though no CISA KEV listing was identified, and the practical impact is bounded to order status modification rather than data breach or site takeover.
Insecure Direct Object Reference in the WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated user holding the vendor role to tamper with product variations owned by other vendors and to overwrite the status and title of arbitrary WordPress posts. The root cause is that the plugin never validates whether a user-supplied object ID actually belongs to the requesting vendor before persisting changes. A publicly available proof-of-concept exploit exists; the issue is not currently listed in CISA KEV.
Missing order-ownership verification in WC Vendors WordPress plugin before 2.7.2.1 allows any authenticated vendor to manipulate shipment records belonging to other vendors. An attacker with a valid vendor account can submit a front-end shipment status update referencing any order ID regardless of ownership, causing the order to be falsely marked as shipped, an order note to be injected under the victim vendor's identity, and the customer to receive a fraudulent dispatch notification. A publicly available proof-of-concept exists via WPScan; no active exploitation is confirmed in CISA KEV.
CSRF protection is absent on front-end order shipment status actions in the WC Vendors WordPress plugin before version 2.7.2.1, allowing network-based attackers to manipulate a logged-in vendor's order shipment state by inducing them to visit a crafted page. The vulnerability requires no attacker authentication and no special deployment configuration beyond active vendor use of the plugin's front-end dashboard. A publicly available exploit exists via WPScan, though no CISA KEV listing was identified, and the practical impact is bounded to order status modification rather than data breach or site takeover.