Quick answers
- Is CVE-2026-81427 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-81427 being exploited in the wild.
- How severe is CVE-2026-81427?
- Medium severity, with a CVSS score of 4.3, published 2 September 2026.
- Which products and versions are affected?
- WC Vendors before 2.7.2.1.
- Is there a fix for CVE-2026-81427?
- A patch was published on 2026-09-02: Fixed in version 2.7.2.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-81427 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-81427?
- Check whether you run WC Vendors at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the order shipment status change handler. When a vendor submits a mark-shipped request via the front-end [wcv_orders] shortcode, the plugin does not verify that the authenticated vendor owns the order or product referenced in the request. An attacker can enumerate sequential order IDs and product IDs belonging to other vendors, then submit crafted POST requests to mark arbitrary orders as shipped while providing their own product ID to reach the handler code. No nonce validation is present. The attack requires vendor-level authentication and depends on vendor self-registration being enabled (the default), but otherwise requires no further preconditions. The vendor can forge order notes, trigger customer and admin notification emails, and modify order state. This issue is fixed in version 2.7.2.1.
Affected products
- WC Vendors WC Vendors before 2.7.2.1
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 2.7.2.1