CVE-2026-127207 · Package
NO FIX YET · SEE WHAT TO DO
Sendcloud for WooCommerce through version 1.0.41 lacks permission and nonce checks on its support AJAX actions. An authenticated low-privileged user, such as a WordPress subscriber, can read integration configuration and change the plugin's log level, and a cross-site request can trigger the same calls.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Sites running Sendcloud for WooCommerce up to 1.0.41 where any logged-in account, including a basic subscriber, can reach the plugin's AJAX handlers. Sites without the plugin, or where only trusted staff have accounts, have less exposure. Whether the vendor has released a fixed version is not stated in the sources.
Not affected if no-subscriber-accounts, plugin-not-installed
Who cares self-hosted, sendcloud, woocommerce, wordpress
wp plugin get sendcloud-shipping --field=version if the slug matches.sc_support_get and sc_support_save AJAX actions in the plugin's SCCSP_Support_Controller.Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.