Missing Authorization in Sendcloud Shipping

Executive Summary

CVE-2026-57760 is a Broken Access Control vulnerability in the WordPress Sendcloud Shipping Plugin, affecting versions 1.0.29 and below.

This vulnerability occurs because of missing authorization checks, which allows unauthenticated users to perform actions that normally require higher privileges.

It is classified under OWASP Top 10 A1: Broken Access Control and has a CVSS score of 5.3, indicating a moderate severity level.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers without authentication to perform privileged actions within the Sendcloud Shipping Plugin.

Although the risk is considered low, such vulnerabilities are often targeted in mass-exploit campaigns, potentially leading to unauthorized changes or disruptions in shipping operations.

Since the vulnerability does not impact confidentiality or availability directly (CVSS vector shows no confidentiality or availability impact), the main concern is unauthorized integrity changes.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves missing authorization checks in the Sendcloud Shipping WordPress plugin versions 1.0.29 and below, allowing unauthenticated users to perform privileged actions.

Detection typically involves checking the version of the Sendcloud Shipping plugin installed on your WordPress site to see if it is 1.0.29 or below.

You can detect the plugin version by running commands on your server or using WordPress CLI tools.

• Using WP-CLI to check plugin version: wp plugin list | grep sendcloud
• Manually check the plugin version in the WordPress admin dashboard under Plugins.
• Monitor HTTP requests to the Sendcloud Shipping plugin endpoints for unauthorized access attempts, which may indicate exploitation attempts.

Since the vulnerability is related to broken access control, reviewing web server logs for suspicious unauthenticated requests to Sendcloud Shipping plugin URLs may help detect exploitation.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Sendcloud Shipping plugin to a non-vulnerable version if available.

As of the report date, no official patch is available for this vulnerability.

Therefore, you should consider the following actions:

• Temporarily deactivate or remove the Sendcloud Shipping plugin until a patch or update is released.
• Restrict access to the plugin endpoints via web server configuration or firewall rules to prevent unauthenticated access.
• Consult with your hosting provider or a web developer for assistance in securing your WordPress installation.

Monitoring for suspicious activity and applying general WordPress security best practices is also recommended.

Useful 0 Not Useful 0