CVE-2026-127207
Deferred Deferred - Pending Action

Missing Authorization in Sendcloud for WooCommerce

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: VulnCheck

Description
Sendcloud for WooCommerce through 1.0.41 contains a missing authorization vulnerability that allows authenticated low-privileged users, including Subscribers, to access the sc_support_get and sc_support_save AJAX actions due to the absence of capability and nonce checks in SCCSP_Support_Controller. Attackers can call these wp_ajax_ handlers directly or via cross-site request forgery to disclose integration configuration data such as INTEGRATION_ID, SERVICE_POINT, CARRIERS, and MIN_LOG_LEVEL, and to modify the plugin's logging verbosity. This is an incomplete fix of CVE-2026-57760.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-127207
EUVD
EUVD-2026-124710

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Sendcloud Sendcloud for WooCommerce: Automated Shipping, Branded Tracking & Returns From 0 (inc) to 1.0.41 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Sendcloud for WooCommerce through version 1.0.41 has a missing authorization vulnerability in the sc_support_get and sc_support_save AJAX actions. These actions allow low-privileged authenticated users, including Subscribers, to access and modify plugin settings without proper permission checks. The vulnerability stems from missing capability and nonce verification in SCCSP_Support_Controller.

Impact Analysis

An attacker with low privileges could exploit this to read non-sensitive configuration data like integration IDs, service points, carriers, and log levels. They could also increase the plugin's logging verbosity, potentially exposing more data. Additionally, the lack of nonce validation introduces a CSRF risk.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-127207. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...