Read the docs
TI-2026-68035 Aliases CVE-2026-89289GHSA-r2m9-vxc3-w8ph

Fast Courier Plugin Lets Unauthenticated Users Overwrite Order Tracking Data

Priority LOW 29CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-862.

Summary

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, which is classified as CWE-862 (Missing Authorization). An unauthenticated attacker who supplies the id of any WooCommerce order can overwrite that order's courier status and customer-facing tracking details. The CVSS 3.1 base score is 5.3 (MEDIUM), and CISA has not added the issue to KEV.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00182 7th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownFast Courierup to 5.2.3—No fix listedCNA
  • Fast Courier VendorUnknown Affected up to 5.2.3 Fixed in — No fix listed CNA

Remediation

No fixed version is listed for Fast Courier. Deactivate the plugin, or block unauthenticated requests to its order-status-update REST route, until a fixed release is available.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-89289
  2. 2026-10-06 Alias added: GHSA-r2m9-vxc3-w8ph
  3. 2026-10-06 CVSS score added · CISA ADP
  4. 2026-10-06 Weakness changed · CISA ADP
  5. 2026-10-06 CISA SSVC decision points changed

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences