CVE-2026-8678
Received Received - Intake

Authorization Bypass in MyParcel WordPress Plugin

Publication date: 2026-07-11

Last updated on: 2026-07-11

Assigner: Wordfence

Description
The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view and modify shipment options — including carrier, delivery type, package type, number of labels, weight, signature requirement, and insurance — on any arbitrary order.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-11
Last Modified
2026-07-11
Generated
2026-07-11
AI Q&A
2026-07-11
EPSS Evaluated
N/A
NVD
CVE-2026-8678
EUVD
EUVD-2026-43119

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
myparcel myparcel_plugin to 4.25.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MyParcel plugin for WordPress has an authorization bypass vulnerability in all versions up to and including 4.25.1. This means the plugin does not properly check if a user is allowed to perform certain actions.

As a result, authenticated users with subscriber-level access or higher can view and modify shipment options on any order, even if they should not have permission to do so.

  • Shipment options that can be viewed or changed include carrier, delivery type, package type, number of labels, weight, signature requirement, and insurance.
Impact Analysis

This vulnerability allows unauthorized users with low-level access to manipulate shipment details on any order.

Potential impacts include incorrect shipment configurations, manipulation of delivery preferences, and unauthorized changes that could disrupt order fulfillment.

Although it does not affect confidentiality or availability, it impacts the integrity of shipment data.

Compliance Impact

The vulnerability allows authenticated users with subscriber-level access to view and modify shipment options on any arbitrary order due to authorization bypass.

This unauthorized access and modification capability could potentially lead to violations of data protection and privacy regulations such as GDPR or HIPAA, as it compromises the integrity and confidentiality of order-related data.

However, the provided information does not explicitly state the impact on compliance with these standards.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-8678. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart