CVE-2026-106025
MEDIUM
NVD
CVSS Score
5.3
Severity
MEDIUM
Published
Nov 10, 2026
Vendor
unknown
Description
The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.