{"id":"CVE-2026-106025","kind":"vulnerability","aliases":["CVE-2026-106025"],"related":[],"title":"Cargo Shipping Location for WooCommerce: unauthenticated users can change order shipment statuses","description":"The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.","summary":"The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 exposes a REST API endpoint that updates order shipment statuses without proper access control. An unauthenticated attacker can change order statuses and shipment metadata.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cargo-shipping-location","other","woocommerce","wordpress"],"not_affected_if":["plugin-not-installed","plugin-version-6.0-or-later"],"how_to_check":"- Check the installed version of the Cargo Shipping Location for WooCommerce plugin in the WordPress admin under Plugins, and flag anything below `6.0`.\n- Confirm whether the plugin's REST endpoint that updates shipment statuses is reachable without authentication (unknown if the sources give the exact route).","fix":null,"status":"open","published_at":"2026-11-10T09:17:21+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","triaged_at":"2026-11-10T09:21:27+00:00","updated_at":"2026-11-10T09:21:27+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-10T09:21:27Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Cargo Shipping Location for WooCommerce plugin to `6.0` or later (the sources state 'before 6.0' as the affected range; the exact fixed release is unknown).","reach":"internet","title":"Cargo Shipping Location for WooCommerce: unauthenticated users can change order shipment statuses","impact":"medium","summary":"The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 exposes a REST API endpoint that updates order shipment statuses without proper access control. An unauthenticated attacker can change order statuses and shipment metadata.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","woocommerce","cargo-shipping-location"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Unauthenticated users alter order statuses and shipment metadata","analyst_note":"","how_to_check":"- Check the installed version of the Cargo Shipping Location for WooCommerce plugin in the WordPress admin under Plugins, and flag anything below `6.0`.\n- Confirm whether the plugin's REST endpoint that updates shipment statuses is reachable without authentication (unknown if the sources give the exact route).","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-version-6.0-or-later","plugin-not-installed"],"who_is_affected":"Stores running the Cargo Shipping Location for WooCommerce WordPress plugin before version 6.0 are exposed, because its REST endpoint for order shipment statuses does not check who is calling it. Sites without this plugin, or with version 6.0 or later, are not affected by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000769,"input_tokens":4563,"output_tokens":625,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106025':15A,18A '-2026':14A,17A '6.0':35B,69C 'access':48B,74C 'allow':94C 'api':39B,78C 'attack':52B,89C 'attacker-control':88C 'author':93C 'cargo':1A,20B,27B,61C 'cargo-shipping-loc':19B 'chang':9A,54B 'control':49B,90C 'cve':13A,16A 'endpoint':40B,79C 'expos':36B 'locat':3A,22B,29B,63C 'manipul':98C 'metadata':59B,103C 'order':10A,43B,55B,82C,99C 'plugin':33B,67C 'proper':47B,72C 'reli':85C 'rest':38B,77C 'restrict':73C 'ship':2A,21B,28B,62C 'shipment':11A,44B,58B,83C,102C 'status':12A,45B,56B,84C,100C 'unauthent':6A,51B,95C 'updat':42B,81C 'user':7A,96C 'valu':91C 'without':46B 'woocommerc':5A,24B,31B,65C 'wordpress':25B,32B,66C","nicknames":[],"mitigations":[],"who_affected":"Stores running the Cargo Shipping Location for WooCommerce WordPress plugin before version 6.0 are exposed, because its REST endpoint for order shipment statuses does not check who is calling it. Sites without this plugin, or with version 6.0 or later, are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cargoshippinglocation","medium","other","woocommerce","wordpress"],"campaign_type":null,"search_a":"'-106025':15A,18A '-2026':14A,17A 'cargo':1A 'chang':9A 'cve':13A,16A 'locat':3A 'order':10A 'ship':2A 'shipment':11A 'status':12A 'unauthent':6A 'user':7A 'woocommerc':5A","search_b":"'6.0':35B 'access':48B 'api':39B 'attack':52B 'cargo':20B,27B 'cargo-shipping-loc':19B 'chang':54B 'control':49B 'endpoint':40B 'expos':36B 'locat':22B,29B 'metadata':59B 'order':43B,55B 'plugin':33B 'proper':47B 'rest':38B 'ship':21B,28B 'shipment':44B,58B 'status':45B,56B 'unauthent':51B 'updat':42B 'without':46B 'woocommerc':24B,31B 'wordpress':25B,32B","search_c":"'6.0':69C 'access':74C 'allow':94C 'api':78C 'attack':89C 'attacker-control':88C 'author':93C 'cargo':61C 'control':90C 'endpoint':79C 'locat':63C 'manipul':98C 'metadata':103C 'order':82C,99C 'plugin':67C 'proper':72C 'reli':85C 'rest':77C 'restrict':73C 'ship':62C 'shipment':83C,102C 'status':84C,100C 'unauthent':95C 'updat':81C 'user':96C 'valu':91C 'woocommerc':65C 'wordpress':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T09:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"contact@wpscan.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106025","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106025","severity":null,"published_at":"2026-11-10T09:17:21+00:00","modified_at":"2026-11-10T09:17:21+00:00","first_seen_at":"2026-11-10T09:21:08+00:00","fetched_at":"2026-11-10T09:21:08+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}