Description

The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order, allowing any authenticated vendor to mark another vendor's order as shipped, add an order note falsely attributed to the victim vendor, and trigger the customer shipment notification email.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-02T06:17:19.280Z",
  "pubdate": "2026-09-02T06:17:19.280Z",
  "executiveSummary": "The WC Vendors WordPress plugin, specifically versions prior to 2.7.2.1, contains an Insecure Direct Object Reference (IDOR) vulnerability within its front-end order management functionality.\nThe vulnerability allows an authenticated vendor to manipulate order statuses and metadata for orders they do not own.\nThe impact includes unauthorized modification of shipment statuses, the injection of fraudulent order notes attributed to other vendors, and the unsolicited triggering of customer-facing notification emails.\nThis flaw stems from a lack of server-side authorization checks when processing front-end shipment status updates.\nAny authenticated user with the 'vendor' role can exploit this, as the system fails to validate the relationship between the authenticated user's ID and the order ID provided in the request.\nThis represents a significant integrity and trust issue, as attackers can disrupt business operations, deceive customers, and manipulate audit trails within the e-commerce platform.\nThere are no specific requirements for complex payloads; the exploitation is achieved through standard authenticated requests where the target order ID is modified to reference a third-party vendor's transaction.",
  "technicalDetails": "The root cause of this vulnerability is an improper access control implementation within the WC Vendors plugin's front-end order processing module. Specifically, the function responsible for handling shipment status updates fails to perform a cross-reference check between the current authenticated vendor's session ID and the order ownership metadata associated with the provided order ID.\nIn a secure implementation, the application should verify that the 'vendor_id' associated with the order corresponds to the 'user_id' authenticated in the current session before processing any status changes. Because this validation is absent, the backend accepts any request that provides a valid order identifier, provided the requester possesses an authenticated vendor account.\nThe attack flow follows an IDOR exploitation pattern. An attacker identifies a target order ID, likely through predictable incrementing sequences or information disclosure within the vendor dashboard. Once the target order ID is acquired, the attacker crafts a POST request targeting the shipment update endpoint. By substituting their own order ID with the target's order ID in the request parameters, the attacker forces the system to execute the update logic against the unauthorized object.\nUpon successful invocation, the application executes the shipment status transition. This triggers three distinct malicious actions: first, the order status is updated in the database to reflect shipment; second, a new order note is injected, often appending text that appears to originate from the legitimate vendor; third, the plugin’s mailer logic triggers a confirmation notification to the customer. Because the system utilizes the legitimate vendor's identity context for these automated notifications, the forged notes and emails appear authentic to both the customer and the shop administrator.\nThe affected component is the vendor-facing shipment update API or handler logic present in all versions prior to 2.7.2.1. The vulnerability is accessible over the network via standard HTTP/HTTPS protocols and requires the attacker to have at least a baseline authenticated 'vendor' role on the WordPress installation. No special privileges beyond standard vendor access are required to traverse or manipulate orders belonging to other platform participants. Post-exploitation impact is characterized by the compromise of data integrity, degradation of customer trust due to fraudulent communications, and the potential for supply chain disruption within the multi-vendor marketplace."
}