Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: WC Vendors 2.7.2.1 Clear all filters
TI-2026-56203 CVE-2026-81428 · GHSA-rcrg-g6hp-vjxv

WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Product and Arbitrary Post Modification via IDOR

Priority LOW 29

The WC Vendors WordPress plugin before 2.7.2.1 does not verify ownership or the object type of user-supplied IDs when saving product variations, allowing authenticated users with the vendor role to modify product variati…

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00299 Published 2026-09-02 Fixed in 2.7.2.1 CWE-639
TI-2026-56202 CVE-2026-81427 · GHSA-4pgf-p454-mf4w

WC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change

Priority LOW 20

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's ord…

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00254 Published 2026-09-02 Fixed in 2.7.2.1 CWE-862
TI-2026-56201 CVE-2026-81426 · GHSA-w2qv-2979-p285

WC Vendors < 2.7.2.1 - Order Shipment Status Change via CSRF

Priority LOW 19

The WC Vendors WordPress plugin before 2.7.2.1 does not have CSRF protection on some of its front-end order shipment status actions, which could allow attackers to make a logged-in vendor change the shipment status of th…

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.00168 Published 2026-09-02 Fixed in 2.7.2.1 CWE-352