{"affected":[{"defaultStatus":"unaffected","ecosystem":"https://wordpress.org/plugins","product":"Cargo Shipping Location for WooCommerce","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"6.0","status":"affected","version":"4.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-106025","cwes":["CWE-284"],"description":"The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API endpoint that updates order shipment statuses, relying on an attacker-controllable value for authorization, allowing unauthenticated users to manipulate order statuses and shipment metadata.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/07169e63-f50e-4e9e-a5c0-1f9e57a3c0dd/"}],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: WPScan","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1794298959682,"publishedAt":1794298959682,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/07169e63-f50e-4e9e-a5c0-1f9e57a3c0dd/"}],"remediation":[],"revision":"fc857484bdded319e5d4f6608f8d84c288e32168e3826b13b2c40e1a443b3a3c","sources":[{"modifiedAt":1794298959682,"name":"CNA: WPScan","retrievedAt":1794301706063,"url":"https://www.cve.org/CVERecord?id=CVE-2026-106025"}],"ssvc":null,"status":"published","title":"Cargo Shipping Location for WooCommerce 4.0.0 - 5.7.1 - Unauthenticated Order Status Manipulation","updatedAt":1794301706063}