Executive brief
WC Vendors is a WordPress plugin that enables multi-vendor marketplace functionality, allowing multiple vendors to manage products and orders on a single WooCommerce store. The plugin fails to verify vendor ownership of orders when accepting shipment status changes from the front-end, allowing any authenticated vendor to mark another vendor's orders as shipped, forge notes attributed to victim vendors, and trigger fake shipment notifications to customers.
Technical details
The vulnerability is a broken access control flaw (CWE-862) in the order shipment status change handler. When a vendor submits a mark-shipped request via the front-end [wcv_orders] shortcode, the plugin does not verify that the authenticated vendor owns the order or product referenced in the request. An attacker can enumerate sequential order IDs and product IDs belonging to other vendors, then submit crafted POST requests to mark arbitrary orders as shipped while providing their own product ID to reach the handler code. No nonce validation is present. The attack requires vendor-level authentication and depends on vendor self-registration being enabled (the default), but otherwise requires no further preconditions. The vendor can forge order notes, trigger customer and admin notification emails, and modify order state. This issue is fixed in version 2.7.2.1.
Affected products
- WC Vendors WC Vendors before 2.7.2.1
Timeline
- 2026-08-31: disclosed
- 2026-09-02: patched: Fixed in version 2.7.2.1