UpHeron
All vulnerabilities

WordPress plugins

CVE-2026-127207

Sendcloud for WooCommerce 1.0.41 Missing Authorization via AJAX Actions

Severity
Medium 5.3
Published
12 Nov 2026
Last changed
12 Nov 2026
Added to UpHeron
12 Nov 2026
Weakness
Missing authorization (CWE-862)
Attack
Over the network · Needs a user account · No user action needed
Attacker can
Read some data · Change some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Sources
CVE Program

Description

Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760.

From the CVE Program.

Affected software

SoftwareAffected versions
Sendcloud Connected Shipping (WordPress plugin)WordPress plugins · wp-plugin:sendcloud-connected-shipping
  • Every version up to 1.0.41

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-127207